Member Avatar for Kavitha Butchi

Hello All,

Is there a way how we can pass a PHP variable whose value has been retrieved from MySQL database to the next page?

Initially I tried this which didnt help me anyway.

// if user login information is CORRECT then redirecting them to the user home page

//retrieving realted userid from db for passing it to next pages

$query="select id from usertable where user='".$_POST['usrname']."' limit 1";
$result = mysql_query($query) or die();
$row = mysql_fetch_object($result);
$passit = $row->id; 

//echo $passit;  =>> this is displaying exactly what i wanted but how to pass this php variable value to the next page? I tried using form ACTION method but I guess it can't pass a PHP variable data to next page!

header("Location: userhomepage.php");

I heard sessions can serve this problem but as I am not familiar with sessions I would like to find if there is some easier way for doing this.Can anyone help me with this!

Thankyou in Advance.

KavithaButchi.

  • 2 Contributors
  • 2 Replies
  • 254 Views
  • 14 Hours Discussion Span
  • Latest Post Latest Post by Kavitha Butchi

Dani AI

Generated

’s query-string trick is a perfectly valid, quick fix and — as confirmed — it will pass a value to the next page. It also exposes that value in the browser address bar, history, server logs and referrers, so it’s not appropriate for anything secret (IDs that map to private data, tokens, passwords, etc.). See OWASP’s note on information exposure via query strings. (owasp.org)

For a safer, standard approach use server-side sessions. Start the session at the top of both pages, store the value in $_SESSION, then perform your redirect. Example (keep this at the very top, before output):

<?php
session_start();
$_SESSION['user_id'] = (int)$userIdFromDb;
session_regenerate_id(true); // regenerate after login to prevent fixation
?>

Call session_start() before you send any output. Regenerating the session ID after authentication is recommended to reduce session-fixation risk. See the PHP session docs and OWASP session-management guidance. (php.net)

On the database side, stop using the old mysql_* functions (they were deprecated and removed) and use prepared statements with PDO or MySQLi to avoid SQL injection. A simple PDO flow: prepare the SELECT with a placeholder, execute with the username, fetch the id, cast it to int, then put that integer into the session. Prepared statements are the recommended pattern. (php.net)

Quick checklist:

  • Use sessions for sensitive values and call session_start() before output.
  • Regenerate the session ID after login.
  • Use PDO/MySQLi prepared statements and validate/cast IDs server-side.
  • Avoid sending sensitive data in URLs (GET).

Recommended Answers

All 2 Replies

Member Avatar for effu

header("Location: userhomepage.php");

One was to pass this variable without sessions is to use the $_GET vars... like this:

header("Location: userhomepage.php?passit=$passit");

Then on the userhomepage.php have some code like this at the top:

//userhomepage.php
if (isset($_GET['passit'])) {
     $passit = $_GET['passit'];
}
Member Avatar for Kavitha Butchi

Thanks a Ton Daedal. This worked!!

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.