$_GET variables being truncated

[stampyhead]

I am placing a URL into $_GET to use it to redirect, but when it does the end of the URL is cut off. For example, I am passing the URL "https://www.example.com/productsubsub.php?cid=2&sid=5&ssid=6", but when it redirects all that is there is "https://www.example.com/productsubsub.php?cid=2". The rest of the URL is gone. Does anyone have any idea why it is doing that?

[filgoods]

Can you attach your code?

[F4nat1c]

It's because it's a secure server (https://) and the other variables are sessions (i assume) which will be blocked by https://

[stampyhead]

No, they're not sessions. This is for an e-commerce site which has categories, subcategories and sub-subcategories for their products. The variables in the URL are the numbers associated with each of those that relate to index numbers in the category, subcategory and subsubcategory tables. The issue in question is on a delete products page. Here is the code for the page:

<?php
include ('header.php');
$idn = ($_GET['idn']);
$ys = ($_GET['ys']);
?>
<table width="750" border="0" align="center" cellpadding="0" cellspacing="0">
  <tr>
    <td bgcolor="#FFFFFF"><table width="740" border="0" align="center" cellpadding="0" cellspacing="0">
      <tr>
        <td><img src="images/20pxh.gif" width="1" height="5"></td>
      </tr>
      <tr>
        <td><img src="images/header.jpg" width="740" height="97"></td>
      </tr>
      <tr>
        <td><img src="images/20pxh.gif" width="1" height="5"></td>
      </tr>
    </table>
      <table width="740" height="360" border="0" align="center" cellpadding="0" cellspacing="0">
        <tr>
          <td width="190" valign="top" class="leftsidebar">
		  <div class="menuheader" style="padding-bottom:25px">&nbsp;</div>
		  <?php 
	require_once ('mysql_connect.php');
	include ('leftmenu.php');
	
	if (!isset($_SESSION['id'])) {
	  include ('login_inc.php');
	 }
	if (isset($_SESSION['id'])) {
		$qses = "SELECT id, type FROM usersnew WHERE id = {$_SESSION['id']}";		
		$rses = @mysql_query ($qses);
		$rowses = mysql_fetch_array ($rses, MYSQL_ASSOC);
		if ($rowses['type'] == 2) {
			include ('sidebar_admin.php');
		}
	}
	
		  ?>
	<div style="padding-top:10px">&nbsp;</div>
	<table width="189" border="0" cellspacing="0" cellpadding="0">
	<tr>
       <td align="center" class="loginBottom"><a href="faq.php" class="whitelinks">FAQ</a> | <a href="contact.php" class="whitelinks">Contact</a></td>
       </tr>
	</table>
</td>
          <td width="550" valign="top">
		  <!--<p class="pageHeader">Edit products </p>-->
          <?php
	require_once ('mysql_connect.php');
		$qdel = "SELECT * FROM products WHERE prod_id = $idn";
		$rdel = @mysql_query ($qdel);
		$rowdel = mysql_fetch_array ($rdel, MYSQL_ASSOC);
		$filename = ($rowdel['photo_filename']);
		
	if(empty($idn) && empty($ys)) {
		header ('Location: index.php');
	} else if ($idn && empty($ys)) {
		$return = ($_SERVER['HTTP_REFERER']);
		echo "<div class=\"pageHeader\">Delete a Product</div>";
		echo "<p class=\"body\">Are you sure you want to delete the product {$rowdel['name']}?</p>";
		echo "<p class=\"body\"><a href=\"admin_deleteproduct.php?idn=$idn&ys=1&loc=$return\">Yes</a> | <a href=\"javascript:onClick=history.go(-1)\">No</a></p>";
	} else {
		//require_once ('mysql_connect.php');
		$query = "DELETE FROM products WHERE prod_id={$_GET['idn']} LIMIT 1";		
			$result = @mysql_query ($query); 
			if (mysql_affected_rows() == 1) {
				$origimg = "$images_dir/$filename";
				unlink($origimg);
				$origthumb = "$images_dir/tb_$filename";
				unlink($origthumb);
				//include ('pagetop_inc.php');
				header ("Location: {$_GET['loc']}");
				echo '<p class="body"><span class="bold">The product has been deleted.</span></p>';
				//include ('pagebottom_inc.php');
				//exit(); 
			}	
	mysql_close(); 
	}
			?>
			</td>
        </tr>
      </table>
      <table width="740" border="0" align="center" cellpadding="0" cellspacing="0">
        <tr>
          <td><img src="images/20pxh.gif" width="1" height="5"></td>
        </tr>
      </table></td>
  </tr>
</table>
<?php
include_once ('footer.php');
?>

[filgoods]

Try using URLEncode function on your URL string. That might fix it.

[stampyhead]

Sweet, it looks like that fixed it. Thanks!
So why does the URL need to be encoded to be passed on like that? Any idea why GET cuts it off when it's not encoded? I'm just curious...

[clamcrusher]

only certain characters are allowed in a url, so you need to encode the characters with urlencode so it consists of only valid characters. if you pass chars that arent valid, your at the mercy of how to browser wants to interpret it.

its also possible header() might do something to it as well, like if you pass new lines to it.