php

[fastworld]

Im building a site for my domains.
Any php gurus know if there is a safe way to get the variable out of an url?
EG. i would point a domain to;
www.sitename/domain.php?name=domainName
the variable being domainName

Not my best subject, php

 

[martin-s]

http://www.php.net/manual/en/reserved.variables.get.php

 

[AssetDomains]

Try this

function check_input($data)
{
    $data = htmlspecialchars($data);
    return $data;
}
if(isset($_GET['name']))
{
$domain = check_input($_GET['name']);
}

 

[tifosi]

If you know the domain then below, otherwise if domain.php is parsing the url and you know the query parameter then GET as above. parse_url very useful if the whole url changes or you're wading through a list of urls. Example assumes one name=domain parameter, more with & will need more work.

$url_data = parse_url($url);
$query_data = $url_data['query'];
$query_data = explode('=', $query_data);
$domain = $query_data['name'];

 

[fastworld]

Thats Great! Thanks for your help guys, ill post the url when done in the website review section

 

[Skinner]

I always add checks, on the lengths, and the nature, if your expecting a number, then check is_numeric, check it as much as possible before allowing it out into the open as it were.

 

[greg2013]

Don't just get the data from URL and process it how you want. It could be anything whatsoever.

Anyone can go to your page www.sitename/domain.php?name=domainName
and change "domainName" to be any data they want.
Your script will then happily take that data and process it, which could be an attack attempt etc.

You need to check the data, ideally from a whitelist of data you know it can only be (ie a list of domain names) or at least check there are no bad chars which cannot be in a domain name.
I'd weed out " ' < and > for starters