Member Avatar for janicemurby

hi all im wondering what i can do to stop this happening
advsearch_result.php?city=&country=&gender=a+man&fage=18&lage=99&accomodate=I+can+Accomodate&minheight=152&sexuality=Straight&bodytype=&race=&piercings=No+piercings&tattoos=No+tattoos&dodrink=&smoker=&pincode=&multipleint=&seeking=a+man&meet_type=&travel=I+can+travel&maxheight=213&partner_sexuality=Straight&partner_body_type=Athletic&partner_race=&partner_piercings=No+piercings&partner_tattoos=No+tattoos&partner_drinking=Don't+drink&partner_smoker=&button.x=90&button.y=19
every time i click submit on a form all this come in address bar after file name the code is currently set as 

$male        = $_GET['gender'];
$seek        = $_GET['seeking'];
$age1        = $_GET['fage'];
$age2        = $_GET['lage'];

etc ...

many thanks jan x

  • 2 Contributors
  • 4 Replies
  • 238 Views
  • 5 Hours Discussion Span
  • Latest Post Latest Post by Member #120589

Dani AI

Generated

That long string is just the GET query string being appended to your action URL. Two quick diagnostics from the sample you posted: the presence of button.x / button.y shows an image-type submit button (those add click coordinates), and leaving the form as GET makes every field visible and bookmarkable. Good call trying POST, — that will stop values appearing in the address bar, but it also removes bookmarkability (tradeoff to keep in mind).

If you want the parameters hidden and to avoid accidental resubmits, switch the form to POST and validate/sanitize on the server. Example patterns to use (do not trust raw input; validate types and whitelist allowed values):

$gender = filter_input(INPUT_POST, 'gender', FILTER_SANITIZE_STRING);
$fage   = filter_input(INPUT_POST, 'fage', FILTER_VALIDATE_INT);
if ($fage === false) { /* handle invalid age */ }

To prevent the browser showing a POST form on refresh (and to keep a clean URL), use Post/Redirect/Get (PRG): accept the POST, store the validated criteria (session, temporary DB row, or a short token), then redirect to the results page which reads the session/token and renders results. Minimal PRG flow:

if ($_SERVER['REQUEST_METHOD'] === 'POST') {
  // validate and store criteria in $_SESSION or DB
  header('Location: advsearch_result.php');
  exit;
}

Practical extras: replace input type="image" with input type="submit" to remove .x/.y params; follow ’s advice to use integer IDs for select values to keep any remaining query strings short and consistent with a normalized schema; always use prepared statements for DB work and escape output with htmlspecialchars when echoing back values. If you need bookmarkable searches without long query strings, store the search and redirect to advsearch_result.php?id=123 (short token id) so URLs stay clean.

Recommended Answers

All 4 Replies

Member Avatar for janicemurby

After reading up just changing to post and see what happens x

Member Avatar for Member #120589

Post will certainly hide it. But the whole point of a get is that it does appear in the address bar so you can bookmark it. Searches should be get as they don't change data. Use post to update add or delete info in a db or to check credentials on login.

Member Avatar for Member #120589

However the query string is very verbose. If you have your db setup as normalised tables then your query string values should mostly be integers. I'm assuming your values are picked from select drop downs. In this case you should pass the value of the option which should be integer values in most cases.

Member Avatar for Member #120589

Example of tables I'd use:

cities
======
id
city
country_id

countries
=========
id
country

gender
======
id
gender

accommodation
=============
id
accommodate

sexuality
=========
id
sexuality

bodytype
========
id
bodytype

races
=====
id
race

piercings
=========
id
piercings

tattoos
=======
id
tattoos

dodrink
=======
id
drink

These ids would be used then for the member table as foreign keys.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.