passing variables via URL

[dbaseboy]

Evening all,

I've spent the last 4 hours banging my head off the desk at this one but Im sure its something simple.

I want to construct and pass across a search string via a URL, ie the selected record is pulled from the database and displayed like so:

Make: Ford
Model: Mondeo
Colour: Blue

Im attempting to set up the results as search options ie click on Ford and it will search for all other Fords, click Blue and it will search for all blue cars.

Heres a snippet of how I saw it:

$make=mysql_result($result,$i,"make");
$makelink = "`make` = '".$make."'";

echo "<a href='dir1a.php?searchstr=".$makelink."' title='Find more ".$make."'>".$make."</a>"; ?>


when I debug by popping an echo $makelink in I get as expected

`make` = 'Ford'

however when I pass it through the URL it passes `make =

Im sure its to do with the quote marks (') however no matter what I try doesnt seem to do anything even escaping them with \ just sends the \ as well.

Help!!!!

 

[jpadie]

i would not expose your data schema in this way. instead construct your links so that they look like this

echo "<a href='dir1a.php?make=$make' title='Find more $make'>$make</a>";

and in your receiving script assemble the query string

<?php
$searchtypes= array('make', 'colour', 'model');
$where=array();
foreach ($_GET as $key=>$val){
	if(in_array($key, $searchtypes)){
		$where[] = "$key=".mysql_escape_string(trim($val));
	}
}
$query = "Select * from cars where " . implode(" and ", $where);
mysql_query($query);
?>

 

[dbaseboy]

Im sure to be doing something wrong however when I do that I now get the following error:

Query error: Unknown column 'Ford' in 'where clause'

 

[Itshim]

I agree with jpadie; you do not want to expose your schema in the url, but as for your first post you need to use urlencode() on $makelink when you echo your html. This will encode the string for use in a query as part of a url.

In jpadie's response he did not add the quotes (to be used in the db query). Such as what is marked in red

<?php
$searchtypes= array('make', 'colour', 'model');
$where=array();
foreach ($_GET as $key=>$val){
    if(in_array($key, $searchtypes)){
        $where[] = "$key=[COLOR=red]'[/color]".mysql_escape_string(trim($val))[COLOR=red]."'"[/color];
    }
}
$query = "Select * from cars where " . implode(" and ", $where);
mysql_query($query);
?>

If you find a db error, echo the complete SQL statement to the screen (as long as the page is not live) and the problems are usually easy to find.

 

[jpadie]

thanks, itshim.