How do I send query vars to another page

Anon

Hi!

I am writing a class which needs to take all query string variables as an array ($HTTP_GET_VARS or $HTTP_POST_VARS), loop through the array and unset some variables I do not need:

$query_var_container = 'HTTP'.strtoupper($this->getMethod()).'VARS';
global $$query_var_container;
$query_vars = $$query_var_container;

// strip control variables from query string
foreach ($this->query_vars as $v)
{
unset($query_vars[$v]);
}

After that I need to write these variables either to the end of a link or to the VALUE attribute of the HIDDEN form element.

-- for HIDDEN elements --
$hidden = '';
foreach ($query_vars as $k=>$v)
{
$hidden .= "<input type=\"hidden\" name=\"$k\" value=\"".addslashes($v)."\">\n";
}
-- for a URL --
$qr = '';
foreach ($query_vars as $k=>$v)
{
$qr .= $k.'='.urlencode($v).'&';
}
if (!empty($qr)) $qr = substr($qr, 0, -1);

I don't quite understand what function to apply to each value taken from the query array. Is it urlencode() alone? Or also addslashes()? Some other function? I read in the PHP.net comments for stripslashes() that urlencode() should be coupled with stripslashes() to do correct conversion for HIDDEN elements' value attribute.
Also, do I have to urlencode() the $k in the above scripts?

Thanks a lot in advance,

Stanislav

mistcat

Stanislav,
If you are printing the variables to a hidden form element, and then submitting that page to another php script, or itself, via a form submit, then you don't need to worry about doing any of the translation yourself, it will be handled by stuff "behind the scenes." In other words your data should be printed to the hidden element value as is, and then in the $HTTP_GET_VARS array it will apear correctly as well, without you having to do any of that fancy jazz.

Now if you just put it into a hyperlink you are going to have to do something like this:

print "<A HREF=\"myscript.php?var1=" . urlencode($var1) . "&var2=" . urlencode($var2) . "\">";

let me know if this helps,
nate

Anon

Hi, Nate!

Thanks for your reply.

What I was concerned about is the comments to the PHP help on urlencode() and addslashes():

-- NOTE TO addslashes() ---
Not sure if this is the right place to put this, but...adding slashes will not work to escape quotes in the VALUE field of hidden elements! Instead, use urlencode() and urldecode().

-- NOTE TO urlencode() --
Note: Be careful about variables that may match HTML entities. Things like &amp, &copy and &pound are parsed by the browser and the actual entity is used instead of the desired variable name. This is an obvious hassle that the W3C has been telling people about for years. The reference is here: » http://www.w3.org/TR/html4/appendix/notes.html#h-B.2.2 PHP supports changing the argument separator to the W3C-suggested semi-colon through the arg_separator .ini directive. Unfortunately most user agents do not send form data in this semi-colon separated format. A more portable way around this is to use &amp; instead of & as the separator. You don't need to change PHP's arg_separator for this. Leave it as &, but simply encode your URLs using htmlentities()(urlencode($data)).

That makes me wonder if I need to also apply htmlentities() to strings encoded for URL and urlencode() to strings slashed for HIDDEN form elements' value attribute. Are you sure I don't need slashes there?

Thanks a lot in advance,
Stas

P.S. I should probably do some testing here, but I am afraid I can overlook something so I rely on a more experienced person in these issues.

mistcat

Hmm. I'm not sure why one would run htmlentities on those hidden form fields, unless you are printing user entered data into those hidden element's values. In that case, it might be wise to run htmlentities on the values, just in case. Now I really don't recommend using hidden form elements to pass user entered data around, and I personally have never had any problems where urlencoded data put directly in the query string has caused any strange behavior. In terms of the form fields, the specification should take care of translating & symbols into their equivilents when submitting the form without you having to manually intercede. The only time I have ever had any problems has been when I created the query string by hand in an hyper link.

So I guess to sum up, (grin) I would say that in my experience form fields don't need to be messed with much, except when displaying that data back to the user, where i would use htmlentities, and when creating hyperlinks its always wise to use urlencode. =)

Hope this helps!
Nate

Anon

Hi again, Nate!

Thanks for your reply.

The class I created enables one to build navigation controls that help the user browse long data sets of records (that span multiple pages). It looks like this:
1 2 3 4 5 6 7 8 9 >>

I have created many forms of this control by extending the main class. One of them presents pages as form buttons.

Now consider the user has performed some search on a database and submits the search form to the data viewing script.
The query string should be preserved in any of the page links and the page=# query variable needs to be replaced with the current one. Because I am taking the query string from $HTTP_GET_VARS, I unset the $page variable and then print $HTTP_GET_VARS, appending $page variable to the end.
For now I decided to use rawurlencode() function for URL - it seems to be the most accurate. However, I don't quite understand its difference from urlencode(). rawurlencode() is used in a quite sophisticated class I downloaded recently so I rely on the developer.

However, with form buttons, the only way to pass other query variables to the next page is via the hidden elements. I don't want to use sessions here. So is stripslashes() the only function I need to apply to the VALUE attribute of HIDDEN fields? I feel that without this function the HTML could be rendered incorrectly.

Thanks a lot in advance,
Stanislav