0

Hoping someone can help . Im trying to pass a parameter from one page to another in order to open a record on the second page based on the first page . Generally quite straight forward , but in this case the parameter im passing is a full name with a space . The code in the "sending" document is 

<p>Sender : <a href="contact.php?con=<?php echo $row_rsetcon['sender'] ?>"><?php echo $row_rsetcon['sender']; ?></a></p>

This passes the parameter correctly to the contact.php file and it appears in the address bar like so ....

http://127.0.0.1/kb1/contact.php?con=John Smith

The receiving code in the file contact.php is ..

$con=($_GET['con']);

However the result on the web page is

You have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near 'Smith' at line 1

If I manually put double quotes around the name , then it works as expected. http://127.0.0.1/kb1/contact.php?con="John Smith"

Can I pass the parameter in Double Quotes or is there a better way to do this ? Ive tried urlencode and rawurlencode , no joy , but maybe im not using them correctly.

I do realise that there are issues with the code in reltion to potential for SQL injection etc... , but its an enclosed internal system.

user229044
  • 232,980
  • 40
  • 330
  • 338
MickS
  • 1
  • You need to write the SQL correctly, not expect the SQL to include proper SQL code fragments. Your problem is basically that you have a massive SQL injection hole and that if the user sends quotes then it exploits that hole to fix your SQL error. Dealing with SQL injection correctly will solve the problem you are experiencing. – Quentin Mar 10 '16 at 14:16
  • "You have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near 'Smith' at line 1". It means you have done something wrong with your sql query, maybe you should post your query so we can help – yangsunny Mar 10 '16 at 14:17
  • Hi and thanks for the help. Im fairly new to this . Do you mean the query on the "sending" page or the "recieving" page ? – MickS Mar 11 '16 at 20:07

0 Answers0