| Lāʻie Techie 2005-01-15, 8:56 am |
| On Sun, 09 Jan 2005 16:24:41 +0000, Alan Cole wrote:
> In article <XicEd.86810$Z7.53841@fe2.news.blueyonder.co.uk>,
> "Shaun Rigby" <shaunrigby16@hotmail.com> wrote:
>
>
> Just put the variable in the link.
> i.e
>
> <a href="filename.php?product_category=CATEGORY_HERE">Category</a>
>
> The php file that the link points to will then use the $product_category
> variable within a SELECT statement to get all the products within the
> category and display them as a list (or however you wish to display them).
>
> Al.
This is true ONLY IF register_globals is turned on (a noted security
hole). Instead, access the $_REQUEST array. You may need to strip the
slashes depending on your php.ini settings.
$category = $_REQUEST['product_category'];
As always, you need to "clean" or "untaint" any data submitted by the
client.
HTH,
La'ie Techie
|