PHP If and Else operating incorrectly

Question

The following PHP should determine if there ?purpose=email and then if it is determine the sting contains ?emailaddress or not. If there is an emailaddress then it triggers one set of scripts and if not another. But regardless it is acting as if emailaddress !== ''; Any idea why.

<?php if($_GET['purpose'] == 'email') {?>
<?php   if($_GET['emailaddress'] !== '') {?>
  <script type="text/javascript">
    alert('<?php echo $_GET['emailaddress'];?>');
    window.setTimeout(function(){
      $('.dirops .loadpanel div span', window.parent.document).html('Complete');
      $('.dirops .loadpanel', window.parent.document).removeClass('slideup');
    },1000);
  </script>
<?php } else { ?>
  <script type="text/javascript">
    window.setTimeout(function(){
      $('.dirops .loadpanel div span', window.parent.document).html('Loading');
      $('.dirops .confirmemail', window.parent.document).addClass('slideup');
    },1000);
    $('#confirmemail', window.parent.document).attr('href', 'http://www.golfbrowser.com/A4/directions.php?purpose=email&start=<?php echo $_GET['start'];?>&end=<?php echo $_GET['end'];?>')
  </script>
<?php   } ?> 
<?php } ?>

Any ideas?

Marvellous

This is example code, right? you wouldn't directly print a query-string variable into the page without escaping, right? "echo $_GET['emailaddress'];" --shudder-- — Robert Martin
– Robert Martin, Commented Sep 21, 2011 at 13:46
$_GET['emailaddress'] might contain, for example, '<script type="text/javascript">(arbitrary JavaScript)</script>' — Hammerite
– Hammerite, Commented Sep 21, 2011 at 14:08
@RobinKnight The danger comes from me sending you a link to ?purpose=email&emailaddress=Hi')%3B%20alert('This%202nd%20alert%20is%20a%20XSS%20attack. or something like that — Robert Martin
– Robert Martin, Commented Sep 21, 2011 at 23:48

user558061 · Accepted Answer · 2011-09-21 13:50:50Z

3

Try if($_GET['emailaddress'] != ''), i.e. != instead of !==

edited Sep 21, 2011 at 13:50

user7675

answered Sep 21, 2011 at 13:50

user558061

1232 silver badges6 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

user7675 Over a year ago

To clarify: when emailaddress is missing, it's probably set to null, and null !== '', causing your "success" condition to run.

zzzzBov Over a year ago

better to use if ( empty( $_GET['emailaddress'] ) )

Christophe Creelle · Accepted Answer · 2011-09-21 13:49:55Z

3

Use: array_key_exists('emailaddress', $_GET) instead of $_GET['emailaddress'] !== ''

edited Sep 21, 2011 at 13:49

user7675

answered Sep 21, 2011 at 13:46

Christophe Creelle

861 silver badge9 bronze badges

Comments

classic · Accepted Answer · 2011-09-21 13:47:59Z

1

if (isset($_GET['emailaddress'])) { ....

answered Sep 21, 2011 at 13:47

classic

5342 silver badges7 bronze badges

1 Comment

Alex Over a year ago

+1. I imagine his if is failing because he's using type comparison as well, and if the GET parameters is absent, the array value is null, and null !== '' is true.

PiTheNumber · Accepted Answer · 2011-09-21 13:51:08Z

1

Somehow I don't think that if/else is not working...

try var_dump($_GET) maybe isset($_GET['emailaddress']) can help you.

answered Sep 21, 2011 at 13:51

PiTheNumber

23.7k17 gold badges114 silver badges191 bronze badges

Comments

RDL · Accepted Answer · 2011-09-21 13:53:29Z

0

Try this changing the first two lines:

<?php if(array_key_exists('purpose', $_GET) && $_GET['purpose'] == 'email') {?>
<?php   if(array_key_exsist('emailaddress', $_GET) && $_GET['emailaddress'] != '') {?>

answered Sep 21, 2011 at 13:53

RDL

8,0013 gold badges32 silver badges32 bronze badges

Collectives™ on Stack Overflow

PHP If and Else operating incorrectly

5 Answers 5

2 Comments

Comments

1 Comment

Comments

Comments

Hot Network Questions

Collectives™ on Stack Overflow

5 Answers 5

2 Comments

Comments

1 Comment

Comments

Comments

Related