1

I have two files, the first is a form (signup.php) that posts user inserted fields (first name, last name, user name, email..etc) into another file containing an error handlers (Signup.chk.php) using post method. in case of error in the inputs, i wanted signup.chk.php to send back all the fields inserted by the user to the signup.php file using GET method to re-display the form with the errors and the user's inputs.

i'm expecting a URL that looks like below:

localhost/signup?signup=error&firstname=Joe&lastname=Doe&user=Jdoe1&email=Jdoe@abc.com

it works fine if the user didnt insert special chars as inputs.

if the user inserts $ or & as part of the inputs it will mess up the _GET function on the other page.

what is the best way to encode/decode the URL values to prevent XSS and also allow the signup.inc file to properly receive the url values and display it correctly in the form fields again (Even if containing <>$&%..etc)

mybrave
  • 1,662
  • 3
  • 20
  • 37
Mohamed Thabet
  • 13
  • 2
  • 1
    Instead of using query params, store the user input into a session variable and retrieve it back on your `signup.php`. Checkout [these](https://www.w3schools.com/php/php_sessions.asp) simple tutorial about sessions on W3Schools,. – ubuntux Apr 12 '20 at 11:25

1 Answers1

0

To do what you want, you can use urlencode() and urldecode().

// To form the URL
$url = "localhost/signup?signup=error&firstname=" . urlencode($firstname);

// To get the value from the URL and decode it.
$firstname = urldecode(isset($_GET['firstname']) ? $_GET['firstname'] : "");

However, there is a security issue, user may add some code on the url to attack your website, so you need to do something to avoid it, eg restrict input length or avoid unnecessary specific characters.

Derek Lam
  • 186
  • 2
  • 2
  • 12
  • Thanks Derek for the urlcode/encode advise that is really helpful. However, as i was going through the learning process of PHP, i realized that i dont need to post the user info in for the registration form using GET. POST will better serve the purpose in my case. – Mohamed Thabet Apr 14 '20 at 14:49