How do i use GET correctly in php? - php

Question

i tried to find a solution for my problem for 2 hours now, but i don't know why my code does not work.
I have a sql output which looks like this:
function output(){
while($row = $this->statement->fetch()) {
$id = $row["id"];
echo '
<tr>
<td>'.$row["comname"].'</td>
<td>'.$row["district"].'</td>
<td>'.$row["industry"].'</td>
<td>"Details"</td>
</tr>
<br>
';
}
If someone click on the link "Details" i want to give out more information about that specific company. Therefore i save the id in the url to identify which company was clicked.
To check if the Details link was clicked, i wrote this:
Edit: just added the "$id = $_GET['details']" after your hints, it looks like this now:
if (isset($_GET['details'])){
$id = $_GET['details'];
echo $id;
}
}
When i click on the link "Details" it changes the URL correctly, but it doesn't print the id. (I don't only want to print the id, i just do this to check the functionality.) Why does my code not work? Is there a second "$GET" i have to use? I really don't know what is going on.
Edit: The php-code ends here, there is nothing i do afterwards.
Edit2: I tried print_r($_GET) and it looks like, the id is not even in the $GET-Array. Also the if (isset($_GET['details'])) statement is not executed.
Thank you!

Answer 1

You should print the $_GET['details']:
if (isset($_GET['details'])){
echo $_GET['details'];
}
Or put it in a variable:
if (isset($_GET['details'])){
$id = $_GET['details'];
echo $id;
}

Answer 2

$_GET[] is just an array of all GET parameters in the URL. You see them for example on https://www.google.com?q=stack+overflow where the parameter q is set to stack+overflow. So if you would echo out $_GET["q"] on that URL you would get stack+overflow. You can store it in a variable like $id and echo it out, but you need to set it first like $id = $_GET["details"];
EDIT: I just realized the code you have now is vulnerable to an attack called XSS or HTML Injection. Since we can specify the $_GET["details"] and so $id that is being echoed, an attacker can put HTML code or the <script> tag in there to execute dangerous JavaScript code on everyone that accesses the URL.
Luckily, there is an easy fix: just put the function htmlspecialchars() around whatever user input you echo. The echo you have here would become echo htmlspecialchars($id);