Question

So I have a php file that retrieves some variables with the $_GET method and then outputs the result. I would want to send one of these retrieved variables to another php file (if it was possible to the same file would be fine also) through a form along with other variables which then are stored in a database. I tried putting the variable in the “action” attribute of the form like this but it didn’t appear in the url when I submitted the form values:

Here is all my code:

<?php 
$nome=$_GET[nome];
$cognome=$_GET[cognome];
echo "<form action='salva_citazione.php"."?autore=".$nome."+".$cognome."&' method='GET'>"
....

Answer 1

You can use hidden input fields, also you forgot to use ' in your $_GET variables:

<?php 
  $nome = htmlspecialchars($_GET['nome']);
  $cognome = htmlspecialchars($_GET['cognome']);
  $fullname  = $nome.' '.$cognome;

  echo '<form action="salva_citazione.php" method="GET">';
  echo '<input type="hidden" name="autore" value="'.$fullname.'" />';
  // ...
?>

Note that this way of using $_GET results in XSS vulnerabilities, so I’ve used htmlspecialchars function to convert special characters to HTML entities.