Passing variables

woodeye

I'm sorry if this info is out there, I swear I've tried looking through dozens of posts, and Google, etc.

Anyway, I'm building a file transfer page, and I'm trying to allow the user to navigate folders that they have permission to, based on a login script.

I am using a "<a href..." to create a link for each file/folder, but in the case of a folder, the script calls itself and sets a "PUT" variable...

For example "<a href = "filelist.php?dir=/upload/user/">folder name</a>"

I just really don't like displaying my folder structure in the URL. I thought of encrypting it with MD5, but I don't know how to decode it so that I can display the selected directory.

So my question is, is there a way to create a link that will set a $_POST variable when it's clicked?

Thanks in advance for any help.

tyrionlannister

You could use POST instead of GET in your form to avoid that string in your URL, but people can still find the string if they're looking. Why would you let users browse through directories but not know the directory's name? You don't need to encrypt the entire structure, just don't let your users know where the base directory is in relation to everything else.

Don't forget to validate your input before using it.

If you want to use POST, you'll need javascript to use an anchor instead of a button. Google "POST via href javascript"

woodeye

Thanks for the reply. I'm not sure if maybe I'm writing this script the wrong way, but I'm not actually putting the directory in between form tags. I'm not at work, so I can't pull my exact code, but from memory, here's what I'm doing:

function displaydirectory($dir){
   $files = scandir($dir,1);

   foreach ($files as $file){
      echo "<a href = '".$_SERVER['PHP_SELF'].'?dir='.$current_dir.$file."'></a>";
   }
}

Where $base_dir would be the actual location on my hard drive for the root directory, and $current_dir would be set via a $current_dir = $_GET['dir']; command.

I'm working all of this through a class object. I don't know if there's a way that I can pass the whole object, so that I retain the current directory without it being passed via a POST or GET variable.

Thanks again!