Passing data from html to php without asking user to fill a form

Question

i'm new to html/php so sorry for the newbie question. i have a 1st HTML page with 2 text fields in a form. By clicking the button at the end of the form i'm going to a PHP page in which i retrieve the data in this way

$id = $_REQUEST['id'];
$password = $_REQUEST['password'];

and it's all good. Anyway in this PHP i have embedded some HTML code with a button

<input type="button" id="fbutton" value="Go Further" onClick="location.href='anotherPage.php'"> <br>

that will lead to another PHP page. The problem is that i need to pass to this last "new" page (anotherPage.php) the $id because i'll use it as a condition (sql WHERE) for a query. But i couldn't find how to pass this $id variable. I could use a form but how can i do that without "printing" anything on screen?

Answer 1

First of all you need to understand the difference between GET and POST requests.

The easiest way to pass data into PHP is to use GET variables. These are appended to the URL in the form of ?key=value&otherKey=otherValue

This is fine for some things such as the id of a post that the page is meant to display. For data that is being submitted (posted) rather than being used to identity the resource you are requesting (getting) you need to use POST as this will not show up in the URL.

You only have forms and AJAX requests that can send POST data.

If you want to post data your easiest way is to use a form. If you don't want to display form fields on your page then you can happily create a <form> tag and include hidden form inputs which will not be displayed in the browser but can contain data that can be passed into PHP.

HOWEVER

There are some basic security things that you need to be aware of.

Firstly, POST can seem more secure than GET. It isn't. Faking post data is very easy to do so you can not rely on it to be clean.

Secondly, if you are using these posted variables in database queries then you need to make sure you are using proper escaping or ideally prepared statements to avoid SQL injection.