2 replies to this topic

[Killswitch]

Hello once again.

I am trying to design a frontend for a CMS backend I have designed. The navigation is two level. First obtain the section title, then the content title. If no content is set, then it just lists off items of the section. I havent gotten around to performing tasks if section isnt set. No problem yet.

I have been keeping friendly URL in mind. I had written a function that takes empty space and replaces it with a dash to make the title of any item friendly for the URL after its rewrite (so the good url doesnt come out as index/section/the news/ - now its index/section/the-news/). I used a function just the opposite to get the correct item from teh database, it removes the dashes and adds empty space.

A friend told me to try urlencode out. I havent played with urlencode before, but am coming up very short and this is all starting to get aggrivating. I am have tried searching, but cant figure this out. How do you appropriatly use urlencode with $_GET? I have tried...

if (isset($_GET['section']))
{
$section = clean(urlencode($_GET['section']));
}

Which returns weird error like : Fatal error: Can't use function return value in write context in C:\xampp\htdocs\templates\index.php on line 12

Any suggestions, tutorials? I have checked out manual on this and what little they offered didnt really help me out. Thanks for any suggestions.

[rc69]

Honestly, if you're retrieving information from the url without the intent of putting it back (i.e. in an anchor tag), you should use urldecode(). If you read the manual, you should understand why.

Other then that, i've never heard of that error, is line 12 the line with the functions?

What all is in the clean() function, and what php version do you have?

[Killswitch]

That was a function that was suggested I use to make sure the $_GET wasn't used maliciously. I've been playing around adjusting the URL testing it, and so far to my knowledge it seems to help. Here it is ...

function cleanGet($x)
{
$x = strip_tags( $x );
$x = htmlspecialchars( $x );
$x = stripslashes( $x );
$x = mysql_real_escape_string( $x );

return $x;
}

I wasnt quite sure how to keep $_GET clean since I wasn't retrieving an integer. I normally would use mysql_real_escape_string by default if I wasn't sure, but the rest seems to do alright. Not quite sure which version of PHP I have, I am pretty sure 5+ (I use Windows XP, A/M/P supplied by XAMPP at Apache Friends).