Web Hosting Talk : Web Hosting Main Forums : Programming Discussion : Need a piece of PHP Code

[mark1hos]

Hi there, I am trying to get a payment page which is called payment.php to automatically display the invoice number.

I thought it was like payment.php?invoice=34343

However, I have tried putting <? print "$invoice" ?> but it displays nothing.

Could someone give me the correct PHP code to get it working?

[maxymizer]

Try with $_GET['invoice']

[mark1hos]

Hi there thanks for that, where do I put that?

[sea otter]

Anywhere you want to use the value. In the case of your first example:

<? echo $_GET['invoice']; ?>

[matrixnet]

<? $invoice = $_GET["invoice"]; print "$invoice"; ?>

[horizon]

PHP Code:

if (isset($_GET['invoice']) || isset($_POST['invoice'])) {
$invoice = (isset($_GET['invoice'])) ? (stripslashes(trim($_GET['invoice']))) : "";
} else {
$invoice = "";
}

if (empty($invoice)) {
die ('Could not get invoice.');

} else {

echo $invoice;
}
unset ($invoice); 


[Czaries]

If you're going to check both $_GET and $_POST, you might as well just check $_REQUEST.

PHP Code:

<?php $invoice = isset($_REQUEST['invoice']) ? $_REQUEST['invoice'] : 0 ; ?>

[horizon]

Either case, would be better this way I think:

PHP Code:

 <?php $invoice = isset($_REQUEST['invoice']) ? intval(trim($_REQUEST['invoice'])) : 0; ?>

My first demonstration above did not demonstrate a return result by value but rather with text (Horizon didn't know it was about value. ).

[mark1hos]

Thank you, its working now using sea otter' suggestion. None of the others worked for me.

[brendandonhu]

Be careful with that as echo'ing directly from $_GET could make you vulnerable to cross site scripting (especially if you use cookies to log your users in, etc.)

[Adam Hallett]

if ( is_numeric($invoice)) {
echo $invoice;
} else {
//something here are logging the input/ip address/time/date/etc
}

So basically if you put everyone's contribution together your script is going to kill.

[Barti1987]

Originally Posted by horizon

PHP Code:

if (isset($_GET['invoice']) || isset($_POST['invoice'])) {
$invoice = (isset($_GET['invoice'])) ? (stripslashes(trim($_GET['invoice']))) : "";
} else {
$invoice = "";
}

if (empty($invoice)) {
die ('Could not get invoice.');

} else {

echo $invoice;
}
unset ($invoice); 


I would really like to see a script you make

Peace,

[horizon]

<?php $invoice = isset($_REQUEST['invoice']) ? intval(trim($_REQUEST['invoice'])) : 0; ?>

Be careful with that as echo'ing directly from $_GET could make you vulnerable to cross site scripting (especially if you use cookies to log your users in, etc.)

As you can see, since my correction above, intval has been used so only numeric value can be returned and nothing else.

Of course, if you'd like to state a more defensive method, you can always use:

PHP Code:

<?php $invoice = (isset($_REQUEST['invoice']) && is_numeric($_REQUEST['invoice'])) ? intval(trim($_REQUEST['invoice'])) : 0; ?>

I would really like to see a script you make

Would you ?

[A-Wing]

Originally Posted by horizon

As you can see, since my correction above, intval has been used so only numeric value can be returned and nothing else.

Of course, if you'd like to state a more defensive method, you can always use:

PHP Code:

<?php $invoice = (isset($_REQUEST['invoice']) && is_numeric($_REQUEST['invoice'])) ? intval(trim($_REQUEST['invoice'])) : 0; ?>

That won't stop someone entering in another number into the url hoping to hit someone else's invoice. You need to also check if the invoice number belongs to the customer currently logged in. Never trust data that comes via. GET and POST routines, and any script that requires register_globals should be burnt

[xelav]

what is the system where you are embedding this line of code? solutions depends on details