When working with iFrames is it possible to pass data to an iframe first and then have the iframe load a page based on data passed to it?

Question

Basically I have this PHP page (call it the parent frame or container) and it will receive $_POST data from another website. However, within the parent frame or container page I need to have an iframe loading a page containing a form. However, I would like to be able to pass the $_POST data to the page specified within the iframe before the iframe page loads so that it can load content based on the $_POST data passed to it from the parent frame.

Is this possible and if so, is it possible also in Internet Explorer browsers 9 and 10? I ask about IE because I'm used to the fact that most things just work on Firefox and Chrome and those are the three browsers that my client cares about supporting.

Does this answer your question? [How to communicate between iframe and the parent site?](https://stackoverflow.com/questions/9153445/how-to-communicate-between-iframe-and-the-parent-site) — Michael Freidgeim, Jun 01 '22 at 20:29

Will · Accepted Answer · 2013-10-31T17:02:09.850

2

Would it be acceptable to pass the POST data to the iframe via GET? If so, you could load the iframe with:

src="iframe.php?data=<?php echo urlencode($_POST['data']) ?>"

edited Oct 31 '13 at 17:02

answered Oct 31 '13 at 16:44

Will

2,343
1
14
14

Always use [`urlencode`](http://php.net/urlencode) to properly encode query string variables and variable names. – Marcel Korpel Oct 31 '13 at 17:00
I think you're thinking of urlencode(), but point taken... http://php.net/manual/en/function.urlencode.php – Will Oct 31 '13 at 17:01
Indeed, I thought it was JavaScript in your example, not PHP. – Marcel Korpel Oct 31 '13 at 17:02

Joren · Answer 2 · 2013-10-31T17:09:04.143

1

Just use GET variables

Send post data to your iframe:

<iframe src="form.php?var=<?php echo urlencode($_POST['yourdata']); ?>" />.

In your form.php you can retrieve the value of var using $_GET['var']:

<?php echo htmlspecialchars($_GET['var']); //will output *yourdata* ?>

edited Oct 31 '13 at 17:09

answered Oct 31 '13 at 16:42

Joren

3,068
25
44

Always use [`urlencode`](http://php.net/urlencode) to properly encode query string variables and variable names. – Marcel Korpel Oct 31 '13 at 17:00
Oh, and when `echo`'ing content to a web page, always use `htmlspecialchars`, otherwise the site is prone to XSS. – Marcel Korpel Oct 31 '13 at 17:05
This was just an example, I don't worry too much about XSS since that is the job of OP. Thanks for the tip tho :) – Joren Oct 31 '13 at 17:06
1

You *should* worry about XSS. I know this is just an example, but an insecure example is a bad example. – Marcel Korpel Oct 31 '13 at 17:08

score 0 · Answer 3 · answered Jul 24 '23 at 01:07

Since google always brings this post up, and there's a way to do it discreetly without URLs:

In your index.php call session_start(); at the very top of the page. Also do this in the page you're invoking via the iframe, e.g. iframe.php

Now both pages have access to the superglobal $_SESSION[""];

If on index.php you set $_SESSION["space"] = " World" then invoke the iframe.php, in iframe.php you can do echo 'hello ' . $_SESSION["space"];

And that should have it output: Hello World

When working with iFrames is it possible to pass data to an iframe first and then have the iframe load a page based on data passed to it?

3 Answers3