?d=12&m=11&y=05 //// PHP string question?

Question

The following code below is from a calendar off a blog site.

When they add [ ?d=12&m=11&y=05 ] to the end of the url, its obvious that they are entering the 12th day, llth month, 2005th year into some variable or array.

1)Is this the _POST Global array or the _GET, or the _SESSION or are these just entered into some user predefined global variable?

2)Based off the url address, how could you echo these results or take the value and set it to another variable
$currentmonth = _POST['m'] ???? _GET['m' ????

3)Does this string contain htmlentities? or anything to do with slashes?

-- code snippet --
8
9
10
11
12

Answer 1

1. Items in a querystring (the URL) are accessed through $_GET. Also, if you use a form with method="get", you access them through $_GET.

Items in a form that has method="post" are obtained by $_POST. It's possible to get data via $_POST from sources other than a form using the post method, but those circumstances are rare.

If you get really confused by which global to use, you can simply use $_REQUEST. It accesses all variables available to the page via POST, GET and COOKIE. However, if two variables have the same name -- such as $_POST['foo'] and $_COOKIE['foo'] -- $_REQUEST will have no idea what you are asking for and crap out. Therefore, if you use $_REQUEST, you have to be very careful to always use unique variable names.

The $_SESSION global is used to record items saved in the session state on the server. You''d need to intentionally be working with a session to use those.

Also, to be clear, PHP has predefined globals. Users can extend PHP to also include predefined globals, but this is far outside the skill set of most PHP users.

2. Working with any global variable is just like working with a regular variable.

$currentmonth = $_GET['m'];

3. The code contains HTML special characters, not entities. The < and > signs are special HTML characters, as is the ampersand and certain other characters.

An entity is a representation of a special character; for example, the less-than sign < is represented by the < entity.

In PHP, you can use the htmlspecialchars() function to change special chars into their entity equivalents.

This:
8"); ?>

Outputs this:
8

That is especially useful if you plan to record user-inputted code in a database and echo it back on a Web page; without encoding special characters into entities, users can put malicious script into your database, displaying which may be fatal.

Answer 2

It's a GET array, POST and SESSION variables don't show up in the URL. In order to get this information out of the URL, use

$currentmonth = $_GET['m']; // Or something similar

$currentmonth should equal 11.

To get the day and year use $_GET['d'] and $_GET['y']
Also, in some versions of PHP, you can use a REQUEST array. It will work with most autoglobal arrays (such as GET, POST, SESSION)

I don't think this string will contain htmlentities, but I'm not for sure.