kaligula1234

I have to use the GET method to send a form entered SQL statement the page that contacts the database. To do this I am using the server variable, the problem is the string is changed to:

SELECT+*+FROM+student+WHERE+studentid+%3D+%27S001% 27

I've been told there is a function i can call will will automatically change the % stuff back to the proper characters but i don't know what it is.

Can anyone help?

Cheers.

sypher

str_replace?

__________________
North Wales Web Design - sypher design

kaligula1234

Someone thought there was a way of doing it that didn't involve doing that for every character seprately. Just a function that was designed to get around this problem. They may have been wrong.

Thanks

sypher

You probably could make a custom function.

__________________
North Wales Web Design - sypher design

kaligula1234

It looks like thats gonna be the case, was hoping there would be a quick way around it cos there are a lot of characters that may need changing.

Thanks anyway

kaligula1234

Found it in the end. parse_str takes the query string and translates all the information into usable strings.

sypher

Nice one

__________________
North Wales Web Design - sypher design

dannyboy26

The information gets urlencoded when passed by using GET; the standard function is to call urldecode:
e.g.
$encoded = "SELECT+*+FROM+student+WHERE+studentid+%3D+%27S001 %27";
$cleanup = urldecode($encoded);

which makes $cleanup become:
SELECT * FROM student WHERE studentid = 'S001'

Cheers

Dan