Comments on: Basic of $_GET variables (PHP)

By: Seich

Seich — Thu, 24 Jun 2010 18:32:38 +0000

It is not really bad for SEO, you can take a look at wordpress for example, all pages are dynamically generated and it works fine with web-crawlers. Pages are pre-rendered by the server for the crawlers so, they see the same as you do. If you are interested in SEO the best thing to do is edit your .htaccess file so that your pages are something more meaningful (http://www.something.com/pagename/ rather than http://www.something.com/index.php?page=pagename). This is used by sites like wordpress and such. I would recommend you check out this tutorial for more information: http://net.tutsplus.com/tutorials/other/using-htaccess-files-for-pretty-urls/

This can be easily achieved if you are pulling information out of a mysql database since, you can just have the url be the query and figure some kind of organization mechanism. Just make sure to double-check for the value being entered to protect yourself from an sql injection as much as possible.

By: JackLloyd

JackLloyd — Thu, 24 Jun 2010 12:21:06 +0000

Just have a question, I was wondering what bots like googles crawler see when you have pages like this? Do they struggle to index your entire site? Basically, it is good for SEO?

By: JackLloyd.

JackLloyd. — Wed, 23 Jun 2010 19:22:31 +0000

Came accross this when searching google. Very helpful thank you!

By: Seich

Seich — Fri, 01 Jan 2010 11:04:23 +0000

I don’t really have a tutorial for that. Sorry. the thing about get variables is that you can freely edit them when you pass them. The best way to have them being safe is to check the values being passed with a very rigorous criteria. escaping characters, making sure it cannot do anything else than what you want it to.
If you tell me a little on what kind of thing you are trying to make I’ll gladly try to help you as much as possible.

By: Zelina

Zelina — Fri, 01 Jan 2010 03:39:13 +0000

Thanks Seich,
That helps introduce me to php and how the previous programmer structured our pages.
Drupal PHP Code Monkey says the GET array isn’t safe.
How do I make it production safe?
Do you have a tutorial?

By: Seich

Seich — Sun, 20 Dec 2009 07:56:49 +0000

daryl :

Hi I just wan to ask :
if I have this var =”THE MAN” can this var be sent by $_GET[] ? tx if you don’t mind pls reply to my email too.
rgds,
-daryl

If you had a variable $test = "hello World" you would be able to pass it on to the next page by adding "?test=Hello World" to the link.. that way you would be able to retrieve it using $test = $_GET['test']; if you are using a form or something of that kind I would recommend using $_POST stuff.. if you give me some few details about what you are trying to do I could be a little more specific..

By: daryl

daryl — Sun, 20 Dec 2009 01:55:33 +0000

Hi I just wan to ask :

if I have this var =”THE MAN”

can this var be sent by $_GET[] ? tx if you don’t mind pls reply to my email too.

rgds,
-daryl

By: Seich

Seich — Sat, 14 Nov 2009 04:37:11 +0000

Drupal PHP Code Monkey :

Values in the GET array should not be trusted. You need to clean them before using them. Including files in this way opens your site up to reading arbitrary files on your web server. Try moving around the fs using ../../ and stuff. Also, echoing the unclean id in the title tag allows for Cross Site Scripting stuff like this: http://martianwabbit.com/page.php?id=alert(/XSS/);

Yes, I definately agree with you, this code example is by no means production safe and shouldn't be used at all. It was mostly used to show how information from the $_GET array could be used.

By: Drupal PHP Code Monkey

Drupal PHP Code Monkey — Fri, 13 Nov 2009 11:01:47 +0000

Wordpress stripped out my tags. If you surround that JavaScript alert with script tags, it will execute and create a JS pop-up. I’ll paste the escaped html here, but wordpress might filter it again. I hope you get the idea.

page.php?id=

By: Drupal PHP Code Monkey

Drupal PHP Code Monkey — Fri, 13 Nov 2009 10:56:07 +0000

Values in the GET array should not be trusted. You need to clean them before using them. Including files in this way opens your site up to reading arbitrary files on your web server. Try moving around the fs using ../../ and stuff. Also, echoing the unclean id in the title tag allows for Cross Site Scripting stuff like this: http://martianwabbit.com/page.php?id=alert(/XSS/);