Display Search Query

how do I display the users search query

[jonspall]

I have created a search form which passes the results to a results page - I simply need to display what the user typed in the previous search form. i.e. YOU SEARCHED FOR "BLAH BLAH"

I am creating PHP pages connected to a mySQL database

many thanks for anyones help!

Jonny

[d40sithui]

How are you storing the search strings?
If you used $_GET, pull it off $_GET.
If you used $_POST, pull of $_POST.
Otherwise, you can save it in $_SESSION and pull it from there.

example with $_POST

<form action="search.php" method="POST">
Search String::<input type="text" name="searchString">
<input type="submit" value="Search">
</form>

search.php

echo "You searched for ".$_POST['searchString'];

[jonspall]

Of course! - I was looking for something more complicated! Many thanks

[rocknbil]

echo "You searched for ".$_POST['searchString'];

Although this "works," you need to be aware that this type of coding is the "foundation" of cross site scripting.

If user input is echoed back to the page results it can be crafted to inject cross site scripting or mysql injection.

Try this (using a get method for this example, but the same thing can be done using post via command line:)

http://www.example.com/yourscript.php?searchString=%22%3E%3Cscript%3Ealert%28123%29%3C%2Fscript%3E%22

Change example.com to your domain, yourscript.php to your script. If you get a Javascript alert, view the source of the resulting page. What you will see is

You searched for <script>alert('123')</script>

If the script content is anything but the harmless alert, you have big trouble on your hands.

It gets worse, this same approach can be abused for mysql injection.

http://www.example.com/yourscript.php?searchString=%20OR%201=1

Be mindful of this, filter your input and output only cleansed data back to the browser.