Member Avatar for twelvetwelve

I'm trying to use the GET method to pass a variable from one page to another

<?php
$id ++;
echo $id;
?>
<input type="hidden" name="quiz" value="venn" />
<?php
echo '<input type="hidden" name="id" value='.$id.'" />'
?>

In the URL it returns the value
http://localhost/moodle/logicquiz/quiz_start.php?answer1=&answer2=&answer3=&answer4=&quiz=venn&id=3%22

My question is this.......how can I get rid of the "%22" because I use the value given from the URL to obtain data from the database.

Thanks for your help
NH

  • 2 Contributors
  • 1 Reply
  • 1K Views
  • 6 Hours Discussion Span
  • Latest Post Latest Post by DMayo

Dani AI

Generated

The trailing %22 is just the URL-encoded double-quote character (ASCII 34). It happens because the HTML you generate for the hidden field contains a stray " at the end of the value, so the browser submits id=3" which becomes id=3%22 in the URL. , your echoed input line is the likely culprit; is right that urldecode will turn %22 back into a quote, but that only treats the symptom instead of fixing the broken HTML.

Fix the HTML generator so the value attribute is properly quoted and escape the value. For example:

echo '<input type="hidden" name="id" value="'.$id.'" />';

or, clearer in template form:

<input type="hidden" name="id" value="<?php echo htmlspecialchars($id, ENT_QUOTES); ?>" />

After changing that, view source (or use the browser inspector) to confirm the input appears as value="3" with no extra quote.

Also harden the server side: never trust raw GET values for database queries. Retrieve and validate/cast the id (for example with filter_input(INPUT_GET, 'id', FILTER_VALIDATE_INT) or (int)$_GET['id']) and use prepared statements. If you cannot edit the generator immediately, a short-term workaround is to trim stray quotes from the incoming value, but fixing the output HTML is the correct solution.

Member Avatar for DMayo

try urldecode

$newurl = urldecode(http://localhost/moodle/logicquiz/quiz_start.php?answer1=&answer2=&answer3=&answer4=&quiz=venn&id=3%22);

urldecode decodes any %## encoding in a given string..

I'm trying to use the GET method to pass a variable from one page to another

<?php
$id ++;
echo $id;
?>
<input type="hidden" name="quiz" value="venn" />
<?php
echo '<input type="hidden" name="id" value='.$id.'" />'
?>

In the URL it returns the value
http://localhost/moodle/logicquiz/quiz_start.php?answer1=&answer2=&answer3=&answer4=&quiz=venn&id=3%22

My question is this.......how can I get rid of the "%22" because I use the value given from the URL to obtain data from the database.

Thanks for your help
NH

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.