Question

I have the same question but…I’m redirecting the user depending on an if statement using headers to a dynamic page that is constructed through a function. For that function to work properly, it needs the parameters passed in the GET portion of the headers.

According to what to the answers provided, this is a bad practice. What way should I be doing it?

function page($title,$msg){
    $title = $_GET['title'];
    $msg = $_GET['msg'];
    echo '<h1>'.$title.'</h1>';

    echo '<p>';
    switch($msg){
        case 1:
            echo 'dwasdwadawdwadwa';
        break;
        case 2:
            echo 'wasdadwadwdad';
        break;
        default:
            echo 'wadasdasd';
        break;
    }
    echo '</p>';
}

ps: feel free to point out anything else you see wrong.

I found this but it doesn’t really help me.

Answer 1

The answer to the question you linked suggests that functions should not rely on any external (e.g. global) variables. $_GET and $_POST (amongst others) are ‘super globals’, a language feature of PHP that makes them available in any scope. This means they may be unexpectedly modified from anywhere in your scripts.

One way to help avoid this is to avoid using super globals in methods and instead – as the answer to the other question suggests – is to instead require parameters for the variables you would otherwise get from the super globals.

E.g., instead of:

function add_user() {
  $user = $_GET['user'];
  // ...
}
add_user();

You would use:

function add_user($user) {
  // ...
}
add_user($_GET['user']);

In your situation, what you would want is:

function page($title, $msg){
  echo '<h1>'.$title.'</h1>';
  echo '<p>';
  switch($msg){
    case 1:
      echo 'dwasdwadawdwadwa';
    break;
    case 2:
      echo 'wasdadwadwdad';
    break;
    default:
      echo 'wadasdasd';
    break;
  }
  echo '</p>';
}

Then, when you call page you would call it as:

page($_GET['title'], $_GET['msg']);