Question

I’m building a quiz web application that is dynamically generated from a database on my server. I have pretty much implemented all the functionality, the only missing piece is making it capable of providing multiple quizzes. Right now I have to manually write in the code $quiz_id = 1, $quiz_title = "geography" in the quiz.php script for it to run correctly. If I can generate the values for these two variables my quiz.php would work for multiple quiz topics.

So, herein lies my problem: I’d like the user to be able to choose from a list of quiz topics (on the page quizlist.php), click on the link of the quiz they want to take, and then bring them to a page with the quiz questions/choices (on the page quiz.php). Additionally, I’d like to send some values from quizlist.php to quiz.php associated with the specific link the user clicked. I’d like to send the quiz_id and quiz_title to the page quiz.php in order to present the correct set of questions.

I believe there is a way to do this using $_GET or $_POST, as well as using $_SESSION. My questions is which way is better? And how do I do it? I hear $_SESSION is more secure but I’m not sure if I am really worried about this data (quiz_id and quiz_title) being secure.

Currently, here is the code for quizlist.php

<?php
  // Start the session
  require_once('startsession.php');

  // Insert the page header
  $page_title = 'Quiz List';
  require_once('header.php');

  require_once('connectvars.php');

  // Make sure the user is logged in before going any further.
  if (!isset($_SESSION['user_id'])) {
    echo '<p class="login">Please <a href="login.php">log in</a> to access this page.</p>';
    exit();
  }

  // Show the navigation menu
  require_once('navmenu.php');

  // Connect to the database
  $dbc = mysqli_connect(DB_HOST, DB_USER, DB_PASSWORD, DB_NAME);

  // Determine number of quizes based on title in quiz table
  $query = "SELECT * FROM quiz";
  $data = mysqli_query($dbc, $query);
  // Loop through quiz titles and display links for each
  while ($row = mysqli_fetch_array($data)) {
    echo '<a href="quiz.php">' . $row['title'] . '</a><br />';
  }

  mysqli_close($dbc);

  // Insert the page footer
  require_once('footer.php');
?>

Thanks for the help!

Answer 1

Use $_GET.

First, you’re going to want to change this line

echo '<a href="quiz.php">' . $row['title'] . '</a><br />';

To something like this:

echo '<a href="quiz.php?id='.$row['id'].'">' . $row['title'] . '</a><br />';

And then in quiz.php, retrieve the appropriate quiz using $_GET['id'] as your primary key to look it up in the database.

You should store your quiz title there too (in the db).

$_GET is appropriate here because you’re just using an ID to determine which quiz to display. There’s no need for confidentiality here. You would use $_POST when you’re submitting form data which alters the database. $_SESSION is useful for storing basic login info and other stuff that must persist across multiple pages for the life of the session, such as wizard forms.