Reading $_POST in PHP / vB

[janaf]

New at php and vB:

I am using PHP direct-eval and using $_POST to read posted data but it seems it is not available with vB? I can not read the passed variable name / value:

PHP Code:

$output = $_POST["mystr"]; 


calling the page with

content.php?305&mystr=hi

Returns nothing

What are my options to pass / read data with vB / php?

I would like to have a simple pull-down menue and read it's value at post / submit, posting to the same page.

Is there another / better way to do this?

I also have a related post problem discribed here:
https://vborg.vbsupport.ru/showthread.php?t=248700

Any input appreciated...

[Eric]

As far as input ($_POST/$_GET/etc), try reading this:

http://www.vbulletin.com/docs/html/codestandards_gpc

So, for example:

PHP Code:

$vbulletin->input->clean_gpc('r', 'mystr', TYPE_STR); 


And it would be available as:

PHP Code:

$vbulletin->GPC['mystr'] 


However, this is all going to depend on where in vBulletin you're trying to use this.

[janaf]

Many thanks!

Looks exactly like what I needed to progress.

I am trying to use this in a php direct eval page and php gadget.

[janaf]

Sorry but I am stuck on the first line. Pasted this into a php direct eval page:

PHP Code:

$vbulletin->input->clean_gpc('r', 'mystr', TYPE_STR); 


I get

Fatal error: Call to a member function clean_gpc() on a non-object in /var....../phpeval.php(97) : eval()'d code on line 1

and I feel like a fool. What the .... should I do?

[blamo]

Try this:

vB::$vbulletin->input->clean_gpc('r', 'mystr', TYPE_STR);

[Marco64Th]

Are you sure that $vbulletin is in scope?

Try adding a:

PHP Code:

global $vbulletin; 


Just before the call to clean_gpc().

[nhawk]

You also need to understand the difference between GET, POST and REQUEST. In general...

GET = Anything passed via a URL
POST = Anything passed via an input (<input type=...etc>)
REQUEST = All GET, POST and COOKIE data.

Using these with vB and not cleaning them with $vbulletin->input->clean.. is bad practice as this could possibly introduce rogue code into the system.

This code..

$vbulletin->input->clean_gpc('r', 'mystr', TYPE_STR);

Could be passing more information than you need.

It's best to narrow down what you need with

$vbulletin->input->clean_gpc('p', 'mystr', TYPE_STR);

or

$vbulletin->input->clean_gpc('g', 'mystr', TYPE_STR);

If I'm wrong on that, someone please correct me.

[kh99]

I'm not an expert on the matter, but I agree with what nhawk says above, except that I think I'd make the decision on using GET, POST, or REQUEST based on if I thought the script was useful as something that would be used as a link or url. That is, even if you're using it to process form data, if you could see it being useful for someone to enter the paramters in a url or to create a link to it, then you could use REQUEST instead of POST.

Also, I think it's important to note that calling clean_gpc() with TYPE_STR does almost nothing to the value, so you still need to be careful if you're using it in a database query or including it directly in the output.