We launched new forums in March 2019—join us there. In a hurry for help with your website? Get Help Now!
    • 17379
    • 26 Posts
    Hallo,
    I have a problem with getting variables from GET request. Simply when i use code like this ( <code>print_r($_GET);</code>)to show GET variables i see only one var, the var from MODx with page parametr.
    Even when i write some vars manual to adress, they are not showed.
    But when i test GET from other individual file it works fine.
    Does MODx blocked other request variables?
    PS: Friendly URL’s are disabled.
    Thanks already for help.
      • 28042 ☆ A M B ☆
      • 24,524 Posts
      How are you passing the variables into the query string? If you are using FURLs, you need to have the first one with a ? and following ones with &. If you are NOT using FURLs, you need to start each one with a &, since the ? is already taken by the document ID (index.php?id=xx)
        Studying MODX in the desert - http://sottwell.com
        Tips and Tricks from the MODX Forums and Slack Channels - http://modxcookbook.com
        Join the Slack Community - http://modx.org
        • 4041
        • 788 Posts
        Maybe this little snippet will help you: create a new snippet with the following code and call it in a document.

        <?php
        /*   GET_test
             usage: add the snippet call to the document content
             [!Get_test!]
             
        */
        // set seperator placeholder
        $seperator = ($modx->config['friendly_urls'] =="1") ? "?" : "&";
        $modx->setPlaceholder('url_sep', $seperator);  // [+url_sep+]
        
        
        $this_doc = $modx->documentObject['id'];
        $modx->setPlaceholder('this_doc', $this_doc);  // [+this_doc+]
        
        // set up the output
        $output ='';
        
        // check for $_GET[''] and set variables accordingly
        // NOTE THAT THIS DOES NOT HAVE ANY SECURITY CHECKING SO THAT PART IS UP TO YOU
        $get_item1 = isset($_GET['get_item1']) ? $_GET['get_item1'] : '';
        $get_item2 = isset($_GET['get_item2']) ? $_GET['get_item2'] : '';
        $get_item3 = isset($_GET['get_item3']) ? $_GET['get_item3'] : '';
        
        // print a link to this page 
        $output .='<p><a href="[~[+this_doc+]~][+url_sep+]get_item1=Value 1&get_item2=Value 2&get_item3=Value 3"></p>';
        
        // print the results
        $output .='<p>Value 1: '.$get_item1.'<br>
                      Value 2: '.$get_item2.'<br>
                      Value 3: '.$get_item3.'</p>';
        
        return $output;
        ?>
          xforum
          http://frsbuilders.net (under construction) forum for evolution
          • 20413
          • 2,877 Posts
          I want to have a rss feed just for Breezer’s posting! FeedX?  cool
            @hawproductions | http://mrhaw.com/

            Infograph: MODX Advanced Install in 7 steps:
            http://forums.modx.com/thread/96954/infograph-modx-advanced-install-in-7-steps

            Recap: Portland, OR (PDX) MODX CMS Meetup, Oct 6, 2015. US Bancorp Tower
            http://mrhaw.com/modx_portland_oregon_pdx_modx_cms_meetup_oct_2015_us_bancorp_tower
            • 29774
            • 386 Posts
            This is will get you in to BIG trouble:

            // check for $_GET[''] and set variables accordingly
            $get_item1 = isset($_GET['get_item1']) ? $_GET['get_item1'] : '';
            $get_item2 = isset($_GET['get_item2']) ? $_GET['get_item2'] : '';
            $get_item3 = isset($_GET['get_item3']) ? $_GET['get_item3'] : '';
            


            You need to sanitize any input from the user or a hacker could append any code they like to the query string and run it on your server. If you’re expecting an integer then do an intval() (at the least), if it’s a string then run some checks, eg:

            function sanitize_string($string, $min='', $max=''){
            	// strip bad characters
            	$string = preg_replace("/[^\w-]/", "", $string);
            	$len = strlen($string);
            	// check length
            	if((($min != '') && ($len < $min)) || (($max != '') && ($len > $max))) {
            		return FALSE;
            	}
              	return $string;
            }
            


            EDIT: if you’re using PHP 5 then you can use filter_var:
            //string
            $var = filter_var($var, FILTER_SANITIZE_STRING);
            
            // int
            $int_options = array("options"=>array("min_range"=>0, "max_range"=>256));
            $var = filter_var($var, FILTER_VALIDATE_INT, $int_options);
            
              Snippets: GoogleMap | FileDetails | Related Plugin: SSL
              • 20413
              • 2,877 Posts
              tnx @therebechips smiley
                @hawproductions | http://mrhaw.com/

                Infograph: MODX Advanced Install in 7 steps:
                http://forums.modx.com/thread/96954/infograph-modx-advanced-install-in-7-steps

                Recap: Portland, OR (PDX) MODX CMS Meetup, Oct 6, 2015. US Bancorp Tower
                http://mrhaw.com/modx_portland_oregon_pdx_modx_cms_meetup_oct_2015_us_bancorp_tower
                • 4041
                • 788 Posts
                My bad, I am so used to creating snippet params that I didn’t even stop to think of the ramifications. Expanding on this a bit I started making a function to sanitize the results and would like feedback please. Here is the current code:

                <?php
                 // set seperator placeholder
                $seperator = ($modx->config['friendly_urls'] =="1") ? "?" : "&";
                $modx->setPlaceholder('url_sep', $seperator);  // [+url_sep+]
                
                
                $this_doc_id = $modx->documentObject['id'];
                $modx->setPlaceholder('this_doc_id', $this_doc_id);  // [+this_doc_id+]
                
                if (!function_exists(sanitize)){
                function sanitize($value, $type='', $min='', $max=''){
                    $type =isset($type) ? $type : '';
                    if($type ==''){
                        $value='No type sent';
                        return $value;
                    }
                
                    $allowed_array =array('string', 'integer');
                    if(!empty($type) && !in_array($type, $allowed_array)){
                        $value='Type not allowed';
                        return $value;
                    }else{
                        switch($type){
                            case '': $value='Type value is empty';
                              return $value;
                            break;
                
                            case 'string';
                              // strip bad characters
                              $value = preg_replace("/[^\w-]/", "", $value);
                              $len = strlen($value);
                              // check length
                              if((($min != '') && ($len < $min)) || (($max != '') && ($len > $max))) {
                                      //return FALSE;
                                      $value='Character params were not correct';
                              }
                              return $value;
                            break;
                
                            case 'integer':
                              $value = intval($value);
                              if((($min != '') && ($value < $min)) || (($max != '') && ($value > $max))) {
                                      //return FALSE;
                                      $value='Wrong criteria, min value of '.$min.' and max value of '.$max.' required';
                              }
                              return $value;
                            break;
                
                            // add more checks here
                            // case '': ''; break;
                
                            default: '';
                        return;
                        }
                    }
                }
                }
                
                // set up the output
                $output ='';
                
                // check for $_GET[''] and set variables accordingly
                $get_item1 = isset($_GET['get_item1']) ? sanitize($_GET['get_item1'], $type='string') : '';
                $get_item2 = isset($_GET['get_item2']) ? sanitize($_GET['get_item2'], $type='integer', $min='3', $max='20') : '';
                $get_item3 = isset($_GET['get_item3']) ? sanitize($_GET['get_item3'], $type='wrong') : 'Empty value';
                $get_item4 = isset($_GET['get_item4']) ? sanitize($_GET['get_item4'], $type='string') : '';
                $get_item5 = isset($_GET['get_item5']) ? sanitize($_GET['get_item5'], $type='integer', $min='2', $max='50') : '';
                $get_item6 = isset($_GET['get_item6']) ? sanitize($_GET['get_item6'], $type='wrong') : 'Empty value';
                
                // print links to this page with various criteria
                $output .='<p>
                <ul>
                <li><a href="[~[+this_doc_id+]~][+url_sep+]get_item1=Value 1&get_item2=5">[~[+this_doc_id+]~][+url_sep+]get_item1=Value 1&get_item2=5</a></li>
                <li><a href="[~[+this_doc_id+]~][+url_sep+]get_item1=B&A)#D Character+@S&get_item2=25">[~[+this_doc_id+]~][+url_sep+]get_item1=B&A)#D Character+@S&get_item2=25</a></li>
                <li><a href="[~[+this_doc_id+]~][+url_sep+]get_item1=me@<supposed to be an AT sign>myemail.com&get_item2=12&get_item3=20^JRE">[~[+this_doc_id+]~][+url_sep+]get_item1=me@<supposed to be an AT sign>myemail.com&get_item2=12&get_item3=20^JRE</a></li>
                <li><a href="[~[+this_doc_id+]~][+url_sep+]get_item4=Value 1&get_item5=5&get_item6=5">[~[+this_doc_id+]~][+url_sep+]get_item4=Value 1&get_item5=5&get_item6=5</a></li>
                </ul>
                </p>';
                
                // print the results
                $output .='<p>Value 1: '.$get_item1.'<br>
                              Value 2: '.$get_item2.'<br>
                              Value 3: '.$get_item3.'</p>';
                              
                $output .='<p>Value 4: '.$get_item4.'<br>
                              Value 5: '.$get_item5.'<br>
                              Value 6: '.$get_item6.'</p>';
                
                
                return $output;
                ?>
                  xforum
                  http://frsbuilders.net (under construction) forum for evolution
                  • 29774
                  • 386 Posts
                  Looks good to me smiley
                    Snippets: GoogleMap | FileDetails | Related Plugin: SSL
                    • 3177
                    • 137 Posts
                    To take this example one step further:
                    I changed the .htaccess file:

                    # For product-detail-pages
                    RewriteRule ^product/(.*)/(.*)/(.*)/(.*)/(.*)/(.*)/(.*).html$ productdetails.html?p1=$1&p2=$2&p3=$3&p4=$4&p5=$5&p6=$6 [L,QSA]
                    RewriteRule ^product/(.*)/(.*)/(.*)/(.*)/(.*).html$ productdetails.html?p1=$1&p2=$2&p3=$3&p4=$4 [L,QSA]
                    RewriteRule ^product/(.*)/(.*)/(.*).html$ productdetails.html?p1=$1&p2=$2 [L,QSA]
                    
                    # For Friendly URLs
                    RewriteCond %{REQUEST_FILENAME} !-f
                    RewriteCond %{REQUEST_FILENAME} !-d
                    RewriteRule ^(.*)$ index.php?q=$1 [L,QSA]
                    
                    

                    This means that page productdetails.html gets some parameters on which it can find a product. Imaging the following url:
                    www.mysite.nl/product/make/ford/type/focus/color/white/553535345complexproductnumber.html

                    You will get the following as GET params:
                    P1 = "make"
                    P2 = "ford"
                    P3 = "type" ... (etc, you get the idea)

                    This is better for Google optimization than the parameters in $_GET variables.