带参数的 PHP 标头位置
声明：本页面是StackOverFlow热门问题的中英对照翻译，遵循CC BY-SA 4.0协议，如果您需要使用它，必须同样遵循CC BY-SA许可，注明原文地址和作者信息，同时你必须将它归于原作者（不是我）：StackOverFlow
原文地址: http://stackoverflow.com/questions/9861925/
Warning: these are provided under cc-by-sa 4.0 license. You are free to use/share it, But you must attribute it to the original authors (not me):
StackOverFlow
PHP Header Location with parameter
提问by Christian Wiles
Is it possible to append a parameter to a PHP Header Location? I'm having trouble getting it to work. Is this syntax actually allowed?
是否可以将参数附加到 PHP 标头位置？我很难让它工作。这种语法实际上允许吗？
$qry = $_SERVER['QUERY_STRING'];
header('Location: http://localhost/blast/v2/?$qry ') ;
it just won't replace $qry wit its actual value....why??
它只是不会用它的实际价值替换 $qry ......为什么？
in the browser it ends up looking like this:
在浏览器中它最终看起来像这样：
http://localhost/blast/v2/?$qry
http://localhost/blast/v2/?$qry
thanks
谢谢
回答by Bojangles
Change the single quotes to double quotes:
将单引号改为双引号：
header("Location: http://localhost/blast/v2/?$qry");
A single quoted string in PHP is treated as a string literal, which is not parsed for variables. Double quoted strings areparsed for variables, so you will get whatever $qrycontains appended, instead of literally $qry.
PHP 中的单引号字符串被视为字符串文字，不会为变量解析。双引号字符串被解析为变量，因此您将获得$qry附加的任何内容，而不是字面上的$qry。
回答by Howard Walker
You can also add multiple parameters via a header like:
您还可以通过标题添加多个参数，例如：
$divert=$row['id']."¶m1=".($param1)."¶m2=".($param2);
header("Location:showflagsab.php?id=$divert");
which adds the two additional paramaters to the original id
将两个额外的参数添加到原始 id
These can be extracted using the $getmethod at their destination
这些可以使用$get目的地的方法提取
回答by Christian Wiles
I know this is a very old post, but please, do not do this. Parameters in a header are XSS vulnerable. You can read more about XSS'ing here: owasp.org/index.php/Cross-site_Scripting_(XSS)
我知道这是一个很老的帖子，但请不要这样做。标头中的参数易受 XSS 攻击。您可以在此处阅读有关 XSS 的更多信息：owasp.org/index.php/Cross-site_Scripting_(XSS)
回答by Vivek G.S
wiles How to Fix the XSS attack on header location
wiles 如何修复头部位置的 XSS 攻击
$param = $_REQUEST['bcd'];
header("Location: abc.php/?id=$param");
