PHP $_GET and $_POST variables are not working properly

Question

I have an error in my code that may seem ridiculously simple to figure out, but I've looked at it for hours and haven't yet been able to determine the problem.

To edit a database record, I use the following link to pass the record id to the edit page:

<a href="edit_short.php?id=<?php echo $short->id; ?>">Edit</a>

...and here is the edit_short.php file:

$title = "";
$short_text = "";
$id = 0;

if (isset($_GET['id'])) {
  $id=$_GET['id'];
  $short = (object)Short::find_by_id($id);

  $title = $short->title; // My problem is the scope of $title and $short_text
  $short_text = $short->short_text; // Is limited within this if statement
}
if (isset($_POST['edit_short_btn'])) {
  echo $title."<br/>";
  echo $short_text."<br/>";
}

This is the form that is submitted:

  <form method="POST" action="edit_short.php" id="post_form">
    <table>
      <tr>
        <td><input type="text" name="title" value="<?php echo $title; ?>" class="textField" placeholder="Title of short"></td>
      </tr>
      <tr>
        <td><textarea name="short_text" id="short_text" placeholder="Short text"><?php echo $short_text; ?></textarea></td>
      </tr>
      <tr>
        <td><input type="submit" name="edit_short_btn" value="Update short"></td>
      </tr>
    </table>
  </form>

I am able to verify that the submitted id is set using $_GET['id'] and I can pass its value to $id in edit_short.php, but when I get the record and set the $title and $short_text variables, I am unable to access them in the if (isset($_POST['edit_short_btn'])) statement.

How do I check that both the $_GET['id'] and the $_POST['edit_short_btn'] are set and still be able to display the $title and $short_text?

Sorry @chris85, `id` is gotten from a table when i clicked the link shown at the start of my question and the form displayed doesn't have anything to do with this `id` so i don't yet see what you mean by passing `id` as a hidden input — Awa Melvine, Jul 22 '16 at 20:59
the form is in the `edit_short.php` file and is supposed to contain the previous values of the record that are to be updated. the form is submitting to `edit_short.php` and the `id` is from a previous page (sorry i didn't include that) — Awa Melvine, Jul 22 '16 at 21:02
Oooh Now i see your point. Thanks so much i don't need to confirm. It'll work — Awa Melvine, Jul 22 '16 at 21:07

score 3 · Answer 1 · answered Jul 22 '16 at 20:53

Based on your code, you'll never have both the $_GET case and $_POST case at the same time. You'll hit the $_GET case after clicking the link (the page URL will include the ?id=... query string), and the $_POST case after submitting the form (no query string).

score 2 · Answer 2 · edited May 23 '17 at 11:53

The GET is only sent with the link click. Your form is sending a POST so all the data points you want should be in the form. You can have hidden values in the form using the hidden input type. So you should be able to use:

<form method="POST" action="edit_short.php" id="post_form">
    <input type="hidden" value="<?php echo intval($_GET['id']);?>" name="id" />
    <table>
      <tr>
        <td><input type="text" name="title" value="<?php echo $title; ?>" class="textField" placeholder="Title of short"></td>
      </tr>
      <tr>
        <td><textarea name="short_text" id="short_text" placeholder="Short text"><?php echo $short_text; ?></textarea></td>
      </tr>
      <tr>
        <td>
</form>

Then use $_POST['id'] on your processing script to get the id. The intval is an XSS prevention method since id will only be an integer. For other approaches to prevent XSS injections see (this won't stop a SQL injection, parameterized queries should still be used on processing script):

How to prevent XSS with HTML/PHP?
https://www.owasp.org/index.php/XSS_(Cross_Site_Scripting)_Prevention_Cheat_Sheet

PHP $_GET and $_POST variables are not working properly

2 Answers2