Adding friend connection to database using GET and POST

juniper747

When you click on someone's profile, I have a script, that checks if a logged in member and another "friend" are already friends, if not I want to send them to a page that allows them to add the friend. I also pass over the friends id ($requestedid) in a GET variable:

in my profile.php?id=$id page I have

//connect to db blah blah
if($isfriendcheck > 0){
    echo "$id and $logOptions_id are already friends! <br />";
    } else {
    	 $requestedid = $id;
    	 header("location: friendrequest.php?requestedid=$requestedid");
    }

in friendrequest.php I have:

<?php
session_start();
//include_once("scripts/checkuserlog.php");

$requestedid = $_GET[requestedid];

if ($_GET['id']) {
     $id = $_GET['id'];
} else if (isset($_SESSION['id'])) {
	 $id = $_SESSION['id'];
} else {
   include_once "index.php";
   exit();
}

if ($_POST[Submit4]) {
//echo "you ($id) and friend ($requestedid) did not post";
include_once "scripts/connect_to_mysql.php";
$sql = mysql_query("INSERT INTO friends (requesting_id, requested_id, request_time)
    		VALUES('$id', '$requestedid', now())")  or die (mysql_error());

echo "You ($id) have successfully sent a friend request to friend ($requestedid)...";
exit();
}
?>

Here's the form:

<body>
<form action="friendrequest.php" method="POST" enctype="multipart/form-data">
<table width="900" border="0" style="background-color:#F2F2F2; border:#999 1px solid;" align="center" cellpadding="0" cellspacing="0">
<tr>
<td>
<?php echo "You ($id) and this member ($requestedid) are not friends... <br/>";?>        

<input type="submit" name="Submit4" value="Send Friend Request" />
</td>
</tr>
</table>
</form>
</body>

What's happening is when it comes to $POST[Submit4], the $requestedid = $GET[requestedid] variable is not being passed...

Can anyone solve this or show me a better way.... thanks

Undrium

From what I can see your form submits immediately to the friendrequest.php, meaning the $requestedid is never set? Not entirely sure about this, the form is located in the profile.php file?

juniper747

No... the form is in the friendrequest.php... the $requestedid variable is set in the profile.php, then passed over to the friendrequest.php via the GET variable through the header("location: friendrequest.php?requestedid=$requestedid")

Undrium

Change this:

<form action="friendrequest.php" method="POST" enctype="multipart/form-data">

to this:

<form action="friendrequest.php?requestedid=<?= $requestedid ?>" method="POST" enctype="multipart/form-data">

You need to pass the variable along one more step than you do now. The above change is just a suggestion, you can do it in several of other ways.

juniper747

Undrium;10979729 wrote:
Change this:
<form action="friendrequest.php" method="POST" enctype="multipart/form-data">
to this:
<form action="friendrequest.php?requestedid=<?= $requestedid ?>" method="POST" enctype="multipart/form-data">
You need to pass the variable along one more step than you do now. The above change is just a suggestion, you can do it in several of other ways.

Thanks Undrium, that worked...

Do you think (for security, since I am passing user id's) I'd be better off, passing the variables through a POST statement from the profile.php?id=$id page? But how would I do that since it's just a header() redirect:

header("location: friendrequest.php?requestedid=$requestedid");

bradgrafelman

juniper747 wrote:
Do you think (for security, since I am passing user id's) I'd be better off, passing the variables through a POST statement from the profile.php?id=$id page?

Security-wise, both are the same (that is, users can view/intercept/change values passed either in the query string or POST'ed as a hidden input element).

juniper747

Ok, returning back to this issue... So far I have the two pages:

profile.php?id=xx and friendrequest.php?requestedid=xx

The profile page redirects to the friendrequest page, IF two members are not "friends". And this is working just fine, even when random id numbers are placed into the profile.php?id=xx.

However, I am running into problems with putting random id numbers into the friendrequest.php?requestedid=xx.

So my question is... is there a quick way to ONLY run the friendrequest.php page if taken there from the profile.php page? In other words, prevent someone directly trying to access the friendrequest.php page...