如何在 php 中正确使用 GET？

Question

i tried to find a solution for my problem for 2 hours now, but i don't know why my code does not work.

I have a sql output which looks like this:

function output(){
    while($row = $this->statement->fetch()) {
        $id = $row["id"];
        echo '
            <tr>
                <td>'.$row["comname"].'</td>
                <td>'.$row["district"].'</td>
                <td>'.$row["industry"].'</td>
                <td>"<a href="?details=' . $id . '">Details</a>"</td>
            </tr> 
            <br>
            ';
    }
                

If someone click on the link "Details" i want to give out more information about that specific company. Therefore i save the id in the url to identify which company was clicked. To check if the Details link was clicked, i wrote this:

Edit: just added the "$id = $_GET['details']" after your hints, it looks like this now:

    if (isset($_GET['details'])){
        $id = $_GET['details'];
        echo $id;
    }
}

When i click on the link "Details" it changes the URL correctly, but it doesn't print the id. (I don't only want to print the id, i just do this to check the functionality.) Why does my code not work? Is there a second "$GET" i have to use? I really don't know what is going on.

Edit: The php-code ends here, there is nothing i do afterwards.

Edit2: I tried print_r($_GET) and it looks like, the id is not even in the $GET-Array. Also the if (isset($_GET['details'])) statement is not executed.

Thank you!

Answer 1

You should print the $_GET['details'] :

if (isset($_GET['details'])){
    echo $_GET['details'];
}

Or put it in a variable:

if (isset($_GET['details'])){
    $id = $_GET['details'];
    echo $id;
}

Answer 2

$_GET[] is just an array of all GET parameters in the URL. You see them for example on https://www.google.com?q=stack+overflow where the parameter q is set to stack+overflow . So if you would echo out $_GET["q"] on that URL you would get stack+overflow . You can store it in a variable like $id and echo it out, but you need to set it first like $id = $_GET["details"];

EDIT: I just realized the code you have now is vulnerable to an attack called XSS or HTML Injection. Since we can specify the $_GET["details"] and so $id that is being echoed, an attacker can put HTML code or the <script> tag in there to execute dangerous JavaScript code on everyone that accesses the URL.

Luckily, there is an easy fix: just put the function htmlspecialchars() around whatever user input you echo . The echo you have here would become echo htmlspecialchars($id);