0

I want to pass on values from a search field and use those values to show posts with specific tags. I'm using get_query_var for this. I'm almost there, but not getting the values in my query. When I echo my both input values I get the right results on the result page but not in my query

I'm using these:

<?php echo $_GET['area'] ?>  <?php echo $_GET['persons'] ?>

Which outputs South 8 (that is correct). But how do I get this in my query to work, anyone?

Input is given by a form select name="area". I'm trying to fetch the values from my URL on the searchresults page which looks like this http://xxx/search/?area=South&persons=8

$TagArea = get_query_var('area');
$TagPersons = get_query_var('persons');

The new vars I would like to use in my foreach query

$rand_posts = get_posts("tag={$TagArea+$TagPersons}");

And not getting this to work. If I replace {$TagArea+$TagPersons} into South+8 (hardcoded) I get perfect results. Anyone that can help me get the vars into the query the right way? Thanks in advance.

  • 1
    This is a simple PHP problem: Single ' quotes do not expand the variables, but treat it as simple string. Use " double quotes instead: "tag={$TagArea}". Also care about properly validating input, sanitizing output and escaping data before you hand it over to the database. – kaiser Jan 12 '17 at 22:25
  • sorry if it is offtopic, but since I'm trying to get values into the tag section of the wordpress query I thought it should be ok to post it here. Thank you for the direction, but I'm not getting it fixed by changing single into double quotes. I tried to echo the values instead but that is making the mess a lot bigger. Also tried to use the { } but also no luck. I'm not sure if the get_query_var is the right way and maybe just use $_GET['Area'] instead. – AKNL Jan 12 '17 at 23:24
  • Your problem is that you get nothing from the query var function? Edit your question and ahow a full example please. – kaiser Jan 12 '17 at 23:29
  • 1
    edited, hopefully better this way. – AKNL Jan 13 '17 at 8:09
  • Got it after a few other tries. $area = $_GET[‘area’]; $persons = $_GET['persons’]; $query = new WP_Query( array( 'tag' => "$area+$persons” ) ); – AKNL Jan 13 '17 at 13:08
0

Changed the query and with the direction kaiser gave I got it working.

$area = $_GET['area'];
$persons = $_GET['persons'];
$query = new WP_Query( array( 'tag' => "$area+$persons" ) );
  • 1
    Quick not: Sanitize the data before you send it to the DB. Else even a request from a browser can be used to hack your database. – kaiser Jan 13 '17 at 14:55
  • Thanks kaiser for the notice. I'm not using user input but predefined drop down menus. Also checking if an option is selected and using $_POST instead of $_GET. Is this enough or do I need to include htmlspecialchars or something? Any tips/advice? – AKNL Jan 13 '17 at 19:11
  • 1
    Never trust any input - it could have been modified. Use filter_var() and filter_input() and friends (see: php.net). Hope that helps. – kaiser Jan 13 '17 at 19:22
  • Ok just to be sure :) Using POST instead of GET, before using the var in my query I'm using valid_options to check if any incoming input is in the list, after that I'm using filter_var($area, FILTER_SANITIZE_STRING); and put it into another new var and that one I'm using in my query. Also checking if it's not empty (-1 in this case), because then I'm not using the var at all. Anything else that I might consider? htmlspecialchars? or is that not necessary with the valid_options check? – AKNL Jan 13 '17 at 21:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.