[HOW TO - vB4] Paginating Results

[BBR-APBT]

How to get this to work with $_POST.

Every time I click a link in the pagination it resets the post variables.

When I use $_GET it shows either the security token or the session hash.

Thanks for any help.

[cellarius]

The pagination system, as far as I know, is designed to work with URL parameters only. If you want to preserve data entered via a form in post mode, you need to pass the data entered to the pagination class by adding parameters to the pagenav link, then you need to query it accordingly when the page gets reloaded upon page change. Anyway, wihtout seeing your code it's hard to say where you are going wrong.

[BBR-APBT]

here ya go http://pastebin.com/m5dd777d5

If I use $_get how do I remove the sessionhash or the securitytoken out of the url?

It loads the first page but each page after that has no variables.

[cellarius]

First, whenever you use get or post variables, you should always use the vbulletin input cleaner to make them safe. If you don't know how, there's an article somewhere here.

Second, why would you want to get rid of the sessionhash? It's only showing if you have cookies disabled, and if you remove it, it will break login for people w/o cookies.

Third, as I said, when you change pages, you basically reload them. Post variables won't survive that. You need to save the get parameters into variables, pass those variables as parameters to the pagination URL, and then read them from the URL parameters upon reload.

Basically (forgoing input cleaner here, for simplicity:

PHP Code:

// use if isset constructions below to decide 
// whether $_POST or $_GET should take precedence

$var1 = $_POST['var1']; // coming from your post form - would be easier to use get-method there, too
$var2 = $_GET['var1'];  // coming from the URL parameter


// your code


// then, when initiating pagination add your variable as parameter

$pagenav = construct_page_nav(
    $vbulletin->GPC['pagenumber'],    $perpage,
    $cel_ped['ped_count'],    $vbulletin->options['bbr_peds_url'] . '/results.php?' . $vbulletin->session->vars['sessionurl'] . 'var1=' . $var1, 


[BBR-APBT]

I don't want to get rid of the session hash or security token I just want to hide it from the URL with $_GET for the simple fact is I don't want my users passing their sessionhash or security token around to each other.

On this search page only would it be safe to turn off CSRF_PROTECTION as long as I clean what can be inputed?

[cellarius]

Visibility of the security token is not a problem securitywise. It is visible in the source code anyway. The sessionhash is passed along via URL by vB if cookies are disabled, that's the way it is. And no, disabling CSRF protection is not a good idea, it's there for a reason.

[BBR-APBT]

Thanks so much for all your help man.

Last question do I need to add the following to $_GET forms?

<input type="hidden" name="securitytoken" value="$bbuserinfo[securitytoken]" />
<input type="hidden" name="s" value="$session[sessionhash]" />

[cellarius]

If you're using GET, you don't need the security token, but you do need the session (as I said, leaving that out will break log in for everyone with cookies disabled).

On CSRF protection, you may want to read https://vborg.vbsupport.ru/showthread.php?t=177013

[BBR-APBT]

Again Thanks for all the help Great Article.

Most of my problem boiled down to the sql statment.

I had

SELECT DISTINCT COUNT(blah

When I should have had.

SELECT COUNT(DISTINCT blah

So even with _GET it wasn't working correctly.

I used this same tutorial on several other pages of mine and it went flawlessly.

Thanks again for the fast answers and the great help.


P.S. I secure my code after its working just to narrow down problems.