Member Avatar for bipies

Well, all I want is to pass a variable, just one, to an iframe, I know that is something like:

<iframe src= ''</iframe>

and inside the iframe something like:

$myvar = $_GET['variable'];

But my problem is that my variables are URLS, with "?" and "&" so when I parse that variables throught the Iframe a "not found" happends, is there any way to parse urls as variables to a in iframe?

Thanks!

  • 3 Contributors
  • 3 Replies
  • 903 Views
  • 11 Hours Discussion Span
  • Latest Post Latest Post by Member #120589

Dani AI

Generated

Thread starter is hitting a classic problem: embedding a URL that itself has query characters will confuse the outer iframe src because characters like ? and & are parsed at the outer level. As noted, the simplest principle is to avoid putting raw unescaped query text into another URL. Several practical options follow — each works in different scenarios.

A POST target to an iframe avoids nesting query syntax entirely. Example (submit a hidden form that targets the iframe):

<form id="postToFrame" method="post" action="receiver.php" target="childFrame" style="display:none">
  <input type="hidden" name="remoteUrl" value="http://example.com/path?a=1&b=2">
</form>

<iframe name="childFrame"></iframe>

<script>document.getElementById('postToFrame').submit();</script>

For same-origin pages, the most robust approach is window.postMessage: load the iframe, then send the full URL (or structured data) via postMessage and handle it inside the framed page. That avoids encoding pitfalls and keeps data out of the address bar. Another option when embedding must use a query parameter is to encode the inner URL (percent-encoding or a wrapper like base64 on the sender and decode on the receiver) so the outer parser sees a single parameter value.

A note on 's include suggestion: a PHP include is server-side — it only works if the including server can access the file. For remote targets, either fetch/proxy the content server-side (cURL) or use an iframe with one of the methods above. Final checklist: always HTML-escape attributes when inserting dynamic values, inspect the browser Network panel to confirm the transmitted value, enforce validation/sanitization of any incoming URL (prevent SSRF/XSS), and pick encoding/postMessage/proxy based on same-origin and security requirements.

Recommended Answers

All 3 Replies

Member Avatar for bipies

perfect! Thanks!

Member Avatar for Member #120589

Do you need to use an iframe? Can you not use an include file?

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.