[Last Call] Learn about multicloud storage options and how to improve your company's cloud strategy. Register Now

x
?
Solved

Escape and URLDecode for URL passed using Ajax call

Posted on 2007-04-03
6
Medium Priority
?
468 Views
Last Modified: 2008-02-01
I am using xmlhttp (Ajax) requests to call a PHP program from javascript using the GET method.

I am passing the PHP script a string as parameters which includes the characters %20.  For example, the current call to the PHP program looks like this:

phpparser.php?sqlstr=WHERE fieldname LIKE '%2007.03%' ORDER BY relid ASC

The %20 is cut off the param string when it reaches the PHP script, therefore messing up the MySQL query string I am passing.

I fooled around with escape and URLDecode, but how much of the URL needs to be escaped when using xmlhttp (Ajax) calls?  Should I use escape across the entire URL and then URLDecode in the receiving PHP script?

Thanks
0
Comment
Question by:mamuscia
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 3
  • 2
6 Comments
 
LVL 24

Expert Comment

by:glcummins
ID: 18845832
A BIG word of caution on this:  You are opening up your script to a huge security attack. If you allow an SQL query to be passed as-is to your script and then executed, you have no way of knowing what is in the query. A malicious attacker can wreak havoc on your database with this kind of method.

A better option, if you can, is simple to pass the search term and order by term separately, and reconstruct the SQL statement in the script:

phpparser.php?value1=2007.03&orderby=relid&orderdirection=ASC
0
 

Author Comment

by:mamuscia
ID: 18846022
I have many fields that the form displays to allow a user to enter to search the database.  In my PHP script I execute a SELECT so the user is constrained to reading the DB.  There is also a check to make sure the construct of the WHERE clause is correct.  How would I encode/decode this URL?
0
 
LVL 63

Expert Comment

by:Zvonko
ID: 18847181
You have to encode the query string paramter Values only.
Like this:
"phpparser.php?sqlstr="+escape("WHERE fieldname LIKE '%2007.03%' ORDER BY relid ASC")+"&some="+escape("more parametrs");

You see?
Encoding & and = of the query string is misleading like not encoding special characters in the parameter values.




0
Independent Software Vendors: We Want Your Opinion

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

 
LVL 63

Accepted Solution

by:
Zvonko earned 1000 total points
ID: 18847189
Oh, and for decode you have not to care. That does PHP for you.

0
 

Author Comment

by:mamuscia
ID: 18847203
this works great, thanks!!
0
 
LVL 63

Expert Comment

by:Zvonko
ID: 18847252
You are welcome.
0

Featured Post

VIDEO: THE CONCERTO CLOUD FOR HEALTHCARE

Modern healthcare requires a modern cloud. View this brief video to understand how the Concerto Cloud for Healthcare can help your organization.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Build an array called $myWeek which will hold the array elements Today, Yesterday and then builds up the rest of the week by the name of the day going back 1 week.   (CODE) (CODE) Then you just need to pass your date to the function. If i…
International Data Corporation (IDC) prognosticates that before the current the year gets over disbursing on IT framework products to be sent in cloud environs will be $37.1B.
The viewer will learn the basics of jQuery including how to code hide show and toggles. Reference your jQuery libraries: (CODE) Include your new external js/jQuery file: (CODE) Write your first lines of code to setup your site for jQuery…
The viewer will learn how to create a basic form using some HTML5 and PHP for later processing. Set up your basic HTML file. Open your form tag and set the method and action attributes.: (CODE) Set up your first few inputs one for the name and …
Suggested Courses

650 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question