Accessing html parameter in PHP

Question

I'm trying to do a simple test php script for sessions. Basically it increments a counter (stored in $_SESSION) every time you refresh that page. That works, but I'm trying to have a link to destroy the session which reloads the page with the ?destroy=1 parameter. I've tried a couple of if statements to see if that parameter is set and if so to destroy the session but it doesn't seem to work.

I've even put an if statement in the main body to pop-up a message if the parameter is set - but it doesn't seem to be picked up.

I know I'm doing something silly (I'm a PHP newbie) but I can't seem to find what it is...

See code here:

<?php
if ($_POST['destroy']) {
    session_destroy();
} else {
    session_start();
}    
?>

<html>
    <head>
        <title>Session test</title>
    </head>
    <body>
    <?php
    if (isset($_POST['destroy'])) {
        echo "Destroy set";
    }

    $_SESSION['counter']++;

    echo "You have visited this page " . $_SESSION['counter'] . " times" . "<BR>";
    echo "I am tracking you using the session id " . session_id() . "<BR>";
    echo "Click <a href=\"" . $_SERVER['PHP_SELF'] . "?destroy=1\">here</a> to destroy the session.";
?>

Andrew G. Johnson · Accepted Answer · 2008-08-19 19:52:03Z

6

I think you put

$_POST['destroy']

Instead of

$_GET['destroy']

You need to use a form if you'd like to use a $_POST variable. $_GET variables are stored in the URL.

answered Aug 19, 2008 at 19:52

Andrew G. Johnson

27.1k30 gold badges94 silver badges139 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

Pat · Accepted Answer · 2008-08-19 21:00:08Z

4

By the way you can use

$_REQUEST['destroy']

which would work regardless if the data is passed in a POST or a GET request.

answered Aug 19, 2008 at 21:00

Pat

36.8k18 gold badges75 silver badges87 bronze badges

2 Comments

Álvaro González Over a year ago

Not really a good practice. It's important to make sure your variables come from the expected source.

Pat Over a year ago

Really? why is it important? If someone can fake a GET they can fake a POST as easily. I think it does not mater if your variables come from GET or POST you should treat both as equally untrusted regardless.

Community · Accepted Answer · 2023-11-14 22:25:35Z

2

In the PHP Manual it has code snippet for destroying a session.

session_start();
$_SESSION = array();
if (isset($_COOKIE[session_name()])) {
    setcookie(session_name(), '', time()-42000, '/');
}
session_destroy();

edited Nov 14, 2023 at 22:25

CommunityBot

11 silver badge

answered Aug 19, 2008 at 22:54

grom

16.2k19 gold badges66 silver badges68 bronze badges

Comments

ftdysa · Accepted Answer · 2008-08-19 19:58:50Z

1

Yeah, you're going to want to do

if( $_GET['destroy'] == 1 )

or

if( isset($_GET['destroy']) )

answered Aug 19, 2008 at 19:58

ftdysa

1,2426 gold badges17 silver badges26 bronze badges

Comments

Pierre Spring · Accepted Answer · 2008-08-19 22:29:32Z

0

I know I'm doing something silly (I'm a php newbie) but I can't seem to find what it is...

that is how you are going to learn a lot ;) enjoy it ...

answered Aug 19, 2008 at 22:29

Pierre Spring

10.7k13 gold badges52 silver badges44 bronze badges

Collectives™ on Stack Overflow

Accessing html parameter in PHP

5 Answers 5

Comments

2 Comments

Comments

Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

5 Answers 5

Comments

2 Comments

Comments

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related