Normally in an application you want to de-couple from $_GET and wrap it into a request object:
class Request
{
public function getParameter($name, $default = NULL)
{
return isset($_GET[$name]) ? $_GET[$name] : $default;
}
public function getParameterInt($name, $default = NULL)
{
$value = $this->getParameter($name, NULL);
return NULL === $value ? $default : (int) $value;
}
}
$request = new Request();
$id = $request->getParameterInt('id');
echo '<h1>', $id, '</h1>';
That done, you can replace later on the request implementation with another to run and test your application with non-http requests. This also helps to better structure your code for re-usability.
Use
$_GET
:If the URL is within a variable, use
parse_url
Docs andparse_str
Docs:Edit:
If you've got register globals enabled (which is highly discouraged, so just for completeness), you can do this:
Normally in an application you want to de-couple from
$_GET
and wrap it into a request object:That done, you can replace later on the request implementation with another to run and test your application with non-http requests. This also helps to better structure your code for re-usability.
If you wish to inject it into h1, you can echo it back and use javascript to set the innerhtml of the tag.
You can either use the global array
$_REQUEST[]
, or in your case the explicit$_GET
:To prevent XSS you should also use htmlspecialchars:
You fetch the number from the $_GET array and escape it with htmlspecialchars to prevent XSS attacks:
You should use the $_GET superglobal array, which holds querystring parameters.
For example:
<h1><?php echo $_GET['id']; ?></h1>