PHP url - Is this a viable hack?

Question

Following on from this question, i realised you can only use $POST when using a form...d'oh.

Using jQuery or cURL when there's no form still wouldn't address the problem that i need to post a long string in the url.

Problem

I need to send data to my database from a desktop app, so figured the best way is to use the following url format and append the data to the end, so it becomes:

www.mysite.com/myscript.php?testdata=somedata,moredata,123,xyz,etc,etc,thisgetslong

With my previous script, I was using $GET to read the [testdata=] string and my web host told me $GET can only read 512 chars, so that was the problem.

Hack

Using the script below, I'm now able to write thousands of characters; my question, is this viable or is there a better way?

<?
include("connect.php"); //Connect to the database

//hack - read the url directly and search the string for the data i need

$actual_link = "http://$_SERVER[HTTP_HOST]$_SERVER[REQUEST_URI]";
$findme = '=';
$pos = strpos($actual_link, $findme) + 1; //find start of data to write
$data =  substr($actual_link, $pos); //grab data from url

$result = mysql_query("INSERT INTO test (testdata) VALUES ('$data')");

// Check result
if ($result) {echo $data;}
else echo "Error ".$mysqli->error;

mysql_close(); ?>

Edit: Replaced image with PHP code.

I've learned how not to ask a question - don't use the word hack as it riles peoples feathers and don't use an image for code.

I just don't get how to pass a long string to a formless PHP page and whilst i appreciate people's responses, the answers about cURL don't make sense to me. From this page, it's not clear to me how you'd pass a string from a .NET app for example. I clearly need to do lots of research and apologise for my asinine question(s).

Unrelated and I know this is test code, but be aware that you are vulnerable to SQL injection. — dee-see, Jan 07 '14 at 18:24
Why don't you just send a POST request and put it in the body? — SLaks, Jan 07 '14 at 18:28
@SLaks - i don't know what you mean, sorry for my confusion. Where do i 'put it in the body'? I need to send a large chunk of data from a standalone app and i'm using only a url interface, so how do i create a body? Do you mean i should create a PHP form page and then the script can use $POST? — Data46, Jan 07 '14 at 18:40
If using hacks is the first thing you look for when trying to solve a programmable problem then you should probably rethink your ways because it's in no way practical, neither for you or those who you'll work for. There are many, very good, posts/articles of how to achieve this like the web was intended to do. — Jonast92, Jan 07 '14 at 18:40
@Data46: You need to learn how HTTP works. http://en.wikipedia.org/wiki/POST_(HTTP) — SLaks, Jan 07 '14 at 18:42
There are, I think, quite a few examples of sending data programmatically using POST and cURL [on the web already](https://duckduckgo.com/?q=php+curl+post). — halfer, Jan 07 '14 at 19:16

score 1 · Answer 1 · edited May 23 '17 at 11:56

1

The URL has a practical fixed limit of ~2000 chars, so you should not be passing thousands of chars into the URL. The query portion of the URL is only meant to be used for a relatively short set of parameters.

Instead, you can build up a request body to send via cURL/jQuery/etc for POSTing. This is how a browser will submit form data, and you should probably do the same.

edited May 23 '17 at 11:56

Community

1
1

answered Jan 07 '14 at 18:25

PinnyM

35,165
3
73
81

https://stackoverflow.com/a/3080222/1890644 - from this code how do i pass $myvars from the the url into cURL? Sorry if this sounds obvious, but i just can't see how to pass the data; am i missing something? – Data46 Jan 07 '14 at 18:46

score 0 · Answer 2 · answered Jan 07 '14 at 18:42

In your scenario, there are two important elements that you need to examine.

First, what is the client that is performing the http operation? I can't tell from your text if the client is going to be a browser, or an application. The client is whatever you have in your solution that is going to be invoking a GET or POST operation.

This is important. When you read about query string length limitations online, it's usually within the context of someone using a browser with a long URL. There is no standard across browsers for maximum URL length. But if you think about it in practical fashion, you'd never want to share an immensely large URL by posting it somewhere or sending it in an e-mail; having to do the cut-and-paste into a client browser would frustrate someone pretty quickly. On the other hand, if the client is an application, then it's just two machines exchanging data and there's really no human factor involved.

The second point to examine is the web server. The web server implementation may pose limitations on URL length, or maybe not. Again, there is no standard.

In any event, if you use a GET operation, your constraint will be the minimum of what both your client AND server allow (i.e. if both have no limit, you have no limit; if either has a limit of 200 bytes, your limit is 200 bytes; if one has a 200 byte limit and the other has a 400 byte limit, your limit is 200 bytes)

Taking a look back, you mentioned "desktop app" but have failed to tell us what language you're developing in, and what operating system. It matters -- that's your CLIENT.

Best of luck.

PHP url - Is this a viable hack?

2 Answers2