Member Avatar for kobiperez

I have to take over a php project and I am totally new to php. I have this webpage that displays all packages sent to a customer and I want them to be able to click on the tracking number to do UPS website tracking.

The code:

<?php

$result = mysqli_query($conn, $sql);

if (!$result) {

    exit();
} else {

    if (mysqli_num_rows($result) > 0) {
        while ($row = mysqli_fetch_assoc($result)) {

            echo "<tr>";

            echo "<td><strong>";
            echo $row['trackingno'];
            echo "</td>";
            echo "<td>";
            echo $row['date_shipped'];
            echo "</td>";
            echo "<td>";
            echo $row['desc_reference2'];
            echo "</td>";
            echo "<td>";
            echo $row['status'];
            echo "</td>";
            echo "<td>";
            echo $row['date_delivered'];
            echo "</td>";

            echo "</tr>";
        }
    } else {
        echo "There are no Returns matching search!";
    }
}
?>

I need the "trackingno" to display the number but be able to clik on it and be a link to
http://wwwapps.ups.com/WebTracking/track?track=yes&trackNums=trackingno

Any suggestions will be highly apprecited.

  • 1 Contributor
  • 1 Reply
  • 2K Views
  • 2 Days Discussion Span
  • Latest Post Latest Post by kobiperez

Dani AI

Generated

nice goal. The simplest, safe way is to wrap the trackingno with an <a> tag that points at UPS’s public tracking endpoint over HTTPS, and escape both the attribute and the visible text. Also, make sure you close the <strong> tag (your snippet opens it but never closes).

<?php
$tn = (string)($row['trackingno'] ?? '');
$tnText = htmlspecialchars($tn, ENT_QUOTES, 'UTF-8');
$tnHref = 'https://www.ups.com/track?track=yes&trackNums=' . rawurlencode($tn);

echo '<td><strong><a href="' . $tnHref . '" target="_blank" rel="noopener noreferrer">'
   . $tnText
   . '</a></strong></td>';

Why this helps:

  • Uses HTTPS and the current UPS tracking endpoint (/track with trackNums), which accepts a tracking number via query string. You can test the pattern on the official tracking page. See .
  • Escapes output with htmlspecialchars(...) to avoid XSS if a stored value contains unexpected characters.
  • rawurlencode(...) safely encodes the tracking number for use in a URL.
  • target="_blank" + rel="noopener noreferrer" avoids reverse tabnabbing.

Two extra tips:

  • Keep linking only to https://www.ups.com domains. UPS warns to avoid look‑alike links; see their guidance in .
  • If you consider validating formats, note UPS uses several patterns (not just 1Z), so let UPS handle validation unless you have a strong business rule. See examples under “What do tracking numbers look like?” on the official page.

Apply the same htmlspecialchars(...) treatment to your other cells (desc_reference2, status, etc.) for consistency.

Member Avatar for kobiperez

I was able to accomplish this by using the comment from the "Creating link from a Database table field" post from "pritaeas".

echo "<td><strong> <a href='"]."</a> </td>";

Edited by kobiperez
Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.