PHP在未使用GET的情況下在URL中發佈

Question

我目前正在研究一些代碼。你應該能夠上傳文件並選擇文件類型的文件。

我使用的網址，以便上傳頁面上的數據庫條目，所以我的鏈接應該像

www.mydomain.domain?id=1&type=type 

但是PHP只因爲它使用從以前的頁面獲取得到的ID。

所以它看起來像這樣

www.mydomain.domain?id=1&type= 

所以我的問題是我如何能得到在URL中的選擇？

我用jQuery試過了，但我吮吸它; D。

我的表單代碼：

<?php 
$datetype = $_POST['dateiart']; 
echo $datetype; 
$ek = $_GET['id']; 
?> 

<form action="upload.php?id=<?php echo $ek; ?>&type=<?php echo $datetype;?>" target="_blank" method="post" enctype="multipart/form-data" id="dateiauswahl"> 
    Datei zum hochladen auswählen 
    <input type="file" name="fileToUpload" id="fileToUpload"> <br> 
    <input onclick="myFunction()" type="submit" value="Datei hochladen" name="submit"><br><br> 

<input type="hidden" value="<?php echo $ek?>" id="id" name="submit"><br><br> 

     <label>Dateiart: 
    <select name="dateiart" form="dateiauswahl" size="5"> 
     <option value="EK-Rechnung">EK-Rechnung</option> 
     <option value="Kaufvertrag">Kaufvertrag</option> 
     <option value="VK-Rechnung">VK-Rechnung</option> 
     <option value="Datenblatt">Datenblatt</option> 
     <option value="Sonstige">Sonstige</option> 
    </select> 
    </label> 
    </div> 
</form> 

upload.php的

<?php 
$pdo = new PDO('mysql:host=localhost;dbname=', '', ''); 
$target_dir = "uploads/"; 
$target_file = $target_dir . basename($_FILES["fileToUpload"]["name"]); 
$uploadOk = 1; 
$imageFileType = pathinfo($target_file,PATHINFO_EXTENSION); 
$ek = $_GET['id']; 
$dateiart = $_GET['type']; 
echo $dateiart; 
// Check if file already exists 
if (file_exists($target_file)) { 
    echo "Sorry, file already exists."; 
    $uploadOk = 0; 
} 
// Check file size 
if ($_FILES["fileToUpload"]["size"] > 50000000) { 
    echo "Sorry, your file is too large."; 
    $uploadOk = 0; 
} 
// Allow certain file formats 
if($imageFileType != "jpg" && $imageFileType != "png" && $imageFileType != "jpeg" && $imageFileType != "pdf" 
&& $imageFileType != "gif") { 
    echo "Sorry, only JPG, JPEG, PNG & GIF files are allowed."; 
    $uploadOk = 0; 
} 
// Check if $uploadOk is set to 0 by an error 
if ($uploadOk == 0) { 
    echo "Sorry, your file was not uploaded."; 
// if everything is ok, try to upload file 
} else { 
    if (move_uploaded_file($_FILES["fileToUpload"]["tmp_name"], $target_file)) { 
     echo "The file ". basename($_FILES["fileToUpload"]["name"]). " has been uploaded."; 
    } else { 
     echo "Sorry, there was an error uploading your file."; 
    } 


     $statement = $pdo->prepare("INSERT INTO Dateien (Link, EKNR, Datei_Bezeichnung) VALUES (:Link, :EKNR, :Datei_Bezeichnung)"); 
     $result = $statement->execute(array('Link' => $target_file, 'EKNR' => $ek, 'Datei_Bezeichnung' => $dateiart)); 

} 
?> 

Answer 1

傳遞參數作爲隱藏的投入，而不是形式的行動網址的查詢字符串打印。使用htmlspecialchars函數來防止安全問題。

<?php 
if (!isset($_GET['id']) || !isset($_GET['type'])){ 
    die('Missing parameters'); 
} 
?> 


<form action="upload.php" target="_blank" method="post" enctype="multipart/form-data" id="dateiauswahl"> 
    Datei zum hochladen auswählen 

    <input type="hidden" name="id" value="<?php echo htmlspecialchars($_GET['id']) ?>"> 
    <input type="hidden" name="type" value="<?php echo htmlspecialchars($_GET['type']) ?>"> 


    ....... other inputs 

</form> 

在upload.php腳本中，他們從$_POST超全球。

$ek = $_POST['id']; 
$dateiart = $_POST['type'];