Correct Methods and Best Practices for Passing Multiple Variables via URL in PHP

Fundamental Principles of URL Parameter Passing

In web development, passing parameters through URLs is a common method for data exchange between pages. URL parameters are appended to the end of a URL as a query string, starting with a question mark, with multiple parameters separated by & symbols. Each parameter follows a key=value format. This mechanism allows server-side scripts to retrieve these parameter values via the $_GET superglobal array.

Common Error Analysis and Correction

A typical mistake developers make when concatenating multiple URL parameters is omitting the separators between them. In the original code:

$url = "http://localhost/main.php?email=" . $email_address . $event_id;

This approach results in the email parameter value being the concatenated string of $email_address and $event_id, while the event_id parameter is not correctly passed at all. The correct method is to use the & symbol between parameters:

$url = "http://localhost/main.php?email=" . $email_address . "&event_id=" . $event_id;

URL Encoding and Security Considerations

Directly concatenating URL parameters poses security risks, especially when parameter values contain special characters. PHP provides the urlencode() function to handle this situation:

$url = "http://localhost/main.php?email=" . urlencode($email_address) . "&event_id=" . urlencode($event_id);

A more elegant solution is to use the http_build_query() function, which automatically handles encoding and parameter concatenation:

$params = array(
    'email' => $email_address,
    'event_id' => $event_id
);
$url = "http://localhost/main.php?" . http_build_query($params);

Appropriate Use of Session Variables

If certain data is already stored in the session, such as $event_id in the example, repassing it through the URL is unnecessary. Simply call session_start() on the target page to access session variables:

session_start();
$event_id = $_SESSION['event_id'];

This method is more secure, avoiding the risk of exposing sensitive information in URLs.

Cross-Language Implementation Comparison

Referencing implementations in JavaScript, the principle of parameter concatenation is similar:

var url = "CustomerReturn.asp?id=" + idValue + "&address=" + addressValue;

This further validates the universality of the & symbol as a parameter separator.

Best Practices Summary

In practical development, it is recommended to: use http_build_query() for parameter encoding and concatenation; avoid passing sensitive information in URLs; reasonably utilize session storage to reduce the number of URL parameters; and always validate received parameter values. These practices can significantly enhance application security and stability.