Send a Input, but retain Url formatting - Php - php

Question

Code that Generates the HTML Form:
<form action='inc/q/prof.php' method='post'>
<input type='text' id='addComment' name='addComment' tabindex='3' value='Enter comment' />
</form>
*Php Code that is referenced in <form action = *
<?php
// Insert Comments into Database that user provides
$comm = mysql_real_escape_string($_POST['addComment']);
// following line has changed:
$pID4 = filter_input(INPUT_POST, 'pID', FILTER_SANITIZE_NUMBER_INT);
$cID = mysql_real_escape_string($_POST['courseInfoDD']);
$username = "####";
$password = "####";
$pdo4 = new PDO('mysql:host=localhost;dbname=####', $username, $password);
$pdo4->setAttribute( PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION );
$sth4 = $pdo4->prepare('INSERT INTO Comment (info, pID, cID) VALUES(?,?,?);');
$sth4->execute(array($comm, $pID4, $cID ));
?>

Answer 1

Edit 2:
I assume you call prof.php?pID=120 and then you display the given form? And when you click the form the action references your PHP code? If so, then change the php file which prints your form to this:
<?
$pID = filter_input(INPUT_GET, 'pID', FILTER_SANITIZE_NUMBER_INT);
?>
<form action='inc/q/prof.php' method='post'>
<input type='text' id='addComment' name='addComment' tabindex='3' value='Enter comment' />
<input type="hidden" name="pID" value="<? echo $pID; ?>" />
</form>
Then, in the script handling your form submission, you can access the pID value via
$_POST["pID"]
as seen in my first edit, below:
Edit: Your PHP script would then look like this:
// Insert Comments into Database that user provides
$comm = mysql_real_escape_string($_POST['addComment']);
// following line has changed:
$pID4 = filter_input(INPUT_POST, 'pID', FILTER_SANITIZE_NUMBER_INT);
$cID = mysql_real_escape_string($_POST['courseInfoDD']);
$username = "###";
$password = "####";
$pdo4 = new PDO('mysql:host=localhost;dbname=####', $username, $password);
$pdo4->setAttribute( PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION );
$sth4 = $pdo4->prepare('INSERT INTO Comment (info, pID, cID) VALUES(?,?,?);');
$sth4->execute(array($comm, $pID4, $cID ));
The hidden input field is the best way to pass the variables, since you can access it like a normal submitted POST variable (compare it with your $_POST['courseInfoDD']).
But remember to never use this for security relevant information, since this data can be viewed and changed (e.g. by javascript injection).