如前所述,首先想到的似乎是传递信息的非标准方式。解析值时会产生一些困难。虽然,对我来说,主要问题不是检查/清理/清理 $_GET 上的数据。可能是太明显了,因为几乎所有的答案都是由似乎知道他们在做什么的人给出的,我假设他们只是因为这个而没有提到它
但是请记住,如果您不检查它,您很容易受到攻击和脚本故障。损坏程度取决于您自己的应用程序,因此不容易预测。
无论如何,这就是我要做的,包括 html
<?php
// initialize variables
$variable_1 = false; // assume this is the page you want to load
$variable_2 = false;
$default = 'index.php'; // the idea is to load something controlled by you. index, error, 404, etc.
// process $_GET, check, clean and assign values
if ( isset( $_GET ) !== false ) {
foreach ( $_GET as $keys => $values ) {
// check both, $keys and $values for; character set, length, validity against a white list, content
// using an if to match the $keys garantees that regardless of the order, you will get what you want
if ( $keys === 'field_1' ) {
// do what you have to do with this, for instance ...
$variable_1 = $values;
}
if ( $keys === 'field_2' ) {
// do what you have to do with this, for instance ...
$variable_2 = $values;
}
unset( $_GET[$keys] );
}
unset ( $keys, $values );
}
// check there are no surprises on $_GET. Load and study anything here
if ( empty( $_GET ) === false ) {
// it should be empty, so log what is in here and prepare your code for that
unset( $_GET );
} else {
unset( $_GET );
}
// process the variables according to what you want to do
// if there are just a few options, and they are not going to change often
// use a switch, otherwise, use a method to check if a file/content exists
// for the request and load it. If it doesn't exist, inform the user
// with out giving away internals and suggest a new destination
// process other variables, here or before this part, wherever makes sense
?>
<!DOCTYPE html>
<html lang="en">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
<title>testing get</title>
</head>
<body>
<form method="get" action="test_get_00.php" accept-charset="utf-8">
<p><label for="field_1">write something<input type="text" id="field_1" name="field_1" /></label></p>
<p><label for="field_2">write something<input type="text" id="field_2" name="field_2" /></label></p>
<p><button type="submit">send</button></p>
</form>
</body>
</html>
当然你可以做更多的事情,但是如果你准备好你的表格,包括字符集,你就不用担心了,或者至少有一些已知的元素。这不是万无一失的,但它有帮助。
此外,我上面提到的机制在白名单思维模式下工作,这就是 foreach 的想法,以检查你是否得到了你期望的结果,并在记录后丢弃其余部分。