how to write url in form action

Question

Whenever I use this code to upload a pic to a particular profile with unique id, the web page doesn't show any error, but at same time it doesn't show any uploaded pic, either...

<form action="profile.php" enctype="multipart/form-data" method="post">    
    <input type="file" name="choose" value="choose" />
    <input type="submit" name="filename" value="Upload" />
</form>

I changed this code to...

<form action="<?php profile.php?id=$id ?>" enctype="multipart/form-data" method="post">
    <input type="file" name="choose" value="choose" />
    <input type="submit" name="filename" value="Upload" />
</form>

But I receive an error in the form action. How can I get the image out of it, so that after clicking on the submit button pics are automatically uploaded to the profile page with particular id value?

You could use `echo $id` but you should escape this variable, else you are vulnerable against xss attacks ( https://www.owasp.org/index.php/Cross-site_Scripting_(XSS) ) see ( http://stackoverflow.com/questions/13199095/escaping-variables ) on how you should escape variables. — S.Visser, Feb 15 '17 at 09:43

score 2 · Accepted Answer · answered Feb 15 '17 at 09:37

2

use echo

<form action="profile.php?id=<?php echo $id ?>" enctype="multipart/form-data" method="post">

 <input type="file" name="choose" value="choose" />

 <input type="submit" name="filename" value="Upload" /></form>

answered Feb 15 '17 at 09:37

mith

1,680
1
10
12

score 0 · Answer 2 · answered Feb 15 '17 at 09:59

<form action="<?php echo 'profile.php?id='.$id ; ?>" enctype="multipart/form-data" method="post">

<input type="file" name="choose" value="choose" />

  <input type="submit" name="filename" value="Upload" /></form>

OR you can give hidden field as well, you can find the id from hidden field. Like:

<form action="profile.php" enctype="multipart/form-data" method="post">
<input type="hidden" name="id" value="<?php echo $id ; ?>" />

<input type="file" name="choose" value="choose" />

   <input type="submit" name="filename" value="Upload" /></form>

how to write url in form action

2 Answers2