How to make GET safe

PHP
61

I didn’t mean it was a bad idea or wrong…just that I avoid such things…again, this isn’t coming from an expert, so here’s some salt to go along with it! :wink: I see now your purpose and can offer something of substance…then again, that depends on how you define substance…

aaaanyway…you can easily change your code to not require those ‘special’ characters. Consider this…

In your select input:

echo '<tr><td align="right">Price</td>
  <td align="left">
  <select name="url_opr">
  <option value="any">All</option>

  <option value="et">Equal to</option>>
  <option value="gt">Greater than</option></option>
  <option value="lt">Less than</option> </option>
  </select>&nbsp
  </select>&nbsp</td></tr>';
    echo '<tr><td align="right">Price </td>
    <td align="left"><input type="text" name="cid" size="15" maxlength="25" />&nbsp;</td></tr>';
       echo '<tr><td align="right">Property Type</td>
       <td align="left">
    <select name="pfor">
  <option value="1">Sale</option>';
........

…and in your receiving code:

    // Use a switch or similar to choose the proper operator.
    switch($url_opr) {
        case 'gt':
            $sql_opr = '>=';
            break;
        case 'lt':
            $sql_opr = '<=';
            break;
        default:
            $sql_opr = '=';
            break;
    }
}
                            else //opreator is not all
                        {

                         $prop_for = ( $pfor == 1 ) ? 'sale' : 'hire';
                                        $query .= ' and property_for like \\'' . $prop_for . '\\' and price ' . $sql_opr . ' ' . $var;

                        }

Would that suit your purposes?

PS… you have an extra /select tag in there…

62

Here’s a filtering and escaping cheatsheet “plan of action”:
http://pixelated-dreams.com/archives/231-Filtering-Escaping-Cheat-Sheet.html