通过用户未提供的PHP发布形式发送数据

Question

I need to pass a variable though $_POST. This varaible will never be supplied by the user interacting with the form. Basically when you click a button it grabs a number from a database, I need to transfer this number from one page, to a form, and from that form to another page. Without the user seeing it or being able to edit it. Later I need to be able to create an array with multiple numbers, right now I'm starting small with just the one. I'm sure it's simple. I figured a cookie would work but when I start have to transfer multiple numbers and then access them, I believe I would run into problems. Unless you can store an array within a cookie.

Perhaps imploding the the array of multiple numbers, say

$MyArray = array(1, 2, 3, 4);
$ArrayToString = implode(",",$MyArray);
setcookie("My_Numbers", $ArrayToString, TIMEHERE);

and then when I access them just do

$NewArray = explode(","$_COOKIE['My_Numbers']);
setcookie("My_Numbers", "", PASTTIME);
print_r($NewArray);

I just thought of this while I was writing this up. Hopefully there is a more secure, perhaps easier way.

Answer 1

使用$ _SESSION变量，它将在您所在的所有页面中保持活动状态。直到销毁它们为止

Answer 2

<input name="yourName" type="hidden" value="<?php echo $yourVariable; ?>" />

if you want to stay away from session variables go this route. otherwise $_SESSION is a decent way to go as well. although i'm not sure what the data is exactly and if it truly belongs in a $_SESSION var

EDIT:

using a hypothetical person table

//form page user sees
<?php
$query = "SELECT * FROM `person` WHERE `personId` = '$_GET['personId']`";

//assume we get the data into $row array
?>

<form action="process.php">
    <input name="id" type="hidden" value="<?php echo $row['personId']; ?>" />

    <input name="firstName" type="text" value="<?php echo $row['firstName']; ?>" />

    <input name="lastName" type="text" value="<?php echo $row['lastName']; ?>" />

    <input name="submit" type="submit" value="submit" />
</form>

//process.php
<?php
$query = "UPDATE `person` SET `firstName` = '$_POST['firstName']', `lastName` = '$_POST['lastName']' WHERE `personId` = '$_POST['personId']";
?>

remember this example is VERY vulnerable to SQL injection. please fetch your data a better way.