多字$ GET变量problemin PHP

Question

I am currently writing some search engine, where this page is retrieving some _GET variables from a previous page. This is working as intended.

Now I am using those variables as default value in a POST form. However, for some reason, only the first word for each of them is showing up. The form code is as follows:

<form action = "insert.php" method = 'POST'>
<Place name <input type="text" name="name" size = "30" value= <?php echo $_GET['name']; ?> />

Note that when echoing $_GET['name'] anywhere else in the page, everything is fine. Multiple words show up as expected, but when I use it as a text box default value, only the first word shows up on the textbox.

At first, I thought it had something to do with the way those $_GET variables are sent in the URL so I tried this:

$fullname = array();

 $fullname = explode("%20", $_GET['name']);

 $aaa = implode (' ',$fullname);

...

Place name <input type="text" name="name" size = "30" value= <?php echo $aaa; ?> />

but the result is still the same. If I echo it anywhere else in the page I get the full string, but if it's inside the form only the first word shows up.

What am I missing here?

Answer 1

The value attribute of the input tag needs to be in quotes:

<input type="text" name="name" size = "30" value="<?php echo $_GET['name']; ?>" />"

Otherwise, if $_GET['name'] contains spaces you'll end up with something like: value=John Smith. That will be understood as value=John with an invalid Smith attribute floating around.

Also, consider sanitizing $_GET['name'] with htmlspecialchars. Consider what would happen if $_GET['name'] was "/><script>alert(0)</script><. You'd end up embedding user-controlled code on your website, resulting in a reflected XSS.