Did you ever wanted to access HTTP GET and HTTP POST parameters in your theme?
Starting with Pico 2.0 you can access HTTP GET (i.e. a URL’s query string like
?some-variable=my-value) and HTTP POST (i.e. data of a submitted form) parameters in Twig templates using the
form_param functions. This makes developing awesome themes for your Pico website easier than ever before. Naturally we also expose this API to our plugin developers - so if you’re a plugin developer stay where you are. 😊
This extension filters data by either validating or sanitizing it. This is especially useful when the data source contains unknown (or foreign) data, like user supplied input. For example, this data may come from an HTML form.
There are two main types of filtering: validation and sanitization.
Validation is used to validate or check if the data meets certain qualifications. For example, passing in
FILTER_VALIDATE_EMAILwill determine if the data is a valid email address, but will not change the data itself.
Sanitization will sanitize the data, so it may alter it by removing undesired characters. For example, passing in
FILTER_SANITIZE_EMAILwill remove characters that are inappropriate for an email address to contain. That said, it does not validate the data.
Flags are optionally used with both validation and sanitization to tweak behaviour according to need. For example, passing in
FILTER_FLAG_PATH_REQUIREDwhile filtering an URL will require a path (like
https://example.org/foo) to be present.
One warning beforehand: Input validation is hard! Always validate your input data the most paranoid way you can imagine. Always prefer validation filters over sanitization filters; be very careful with sanitization filters, you might create cross-site scripting vulnerabilities!
As a theme developer you can use the
url_param Twig function to access the value of a HTTP GET parameter. If you rather want to access the value of a HTTP POST parameter, use the
form_param Twig function. Pass the name of the HTTP parameter as first argument and the validation or sanitization filter as second parameter (e.g. `` returns
?page=42 was requested).
As a plugin developer you can use the
Pico::getUrlParameter() method to access HTTP GET parameters, and the
Pico::getFormParameter() method to access HTTP POST parameters. The API is the same: The first argument represents the name of the HTTP parameter, the second argument the validation or sanitization filter to use (e.g.
Pico::getUrlParameter('expand', 'bool') returns
?expand=yes was requested).
|Variable Type||Parameter Name||Description|
||name of the HTTP GET or HTTP POST variable|
||ID (int) or name (string) of the filter to apply; if omitted, all functions will return
||either a associative array of options to be used by the filter (e.g.
||either a bitwise disjunction of flags or a string with the significant part of a flag constant (the constant name is the result of
With a validation filter passed in, all functions return the validated value of the HTTP GET or HTTP POST parameter, or, provided that the value wasn’t valid, either the given default value or
false. With a sanitization filter passed in, all functions return the sanitized value of the HTTP GET or HTTP POST parameter. If the HTTP GET or HTTP POST variable doesn’t exist, all functions will always return either the provided default value or
You can’t use the
FILTER_CALLBACK) with the
form_param Twig functions.
For a complete list of all available filters refer to the documentation of PHP’s
Pass the boolean HTTP GET parameter
expand to expand a details section in your template:
Ask a user about “the answer” using a HTML form and store his decision in the Twig variable
the_answer. Use a regular expression to allow just values that are actually present in the HTML form.
Ask a user how much cat pictures he makes a year and claim that his amount is either sad or not impressive at all. Use the Twig variable
amount and let the parameter default to
0. Use the
float) filter, but tweak its behaviour by passing the
FILTER_FLAG_ALLOW_THOUSAND flag - this allows the user to enter their amount with a thousand separator (e.g.
Found a typo? Something is wrong in this documentation? Just fork and edit it!