Ajax is your only real option for working with PHP. The Browser go to url is designed to open web pages, not pass query strings with Get or Post.
Go to URL
"Navigate to a given URL. Note this uses the same window/tab as is showing the HTML5 game, so this action will end the game. The Target can be used to select which frame to redirect, which is only useful if the game is displayed within a frame (e.g. an iframe embed), and the frame has permission to redirect the parent "
Here's the basic PHP CORS header that I use. It attempts to get a HTTP_ORIGIN from several possible sources. It then compares that origin to two URI's I have plugged in and accepts incoming AJAX requests from them (the host website and the preview editor). I modify this to whatever use I need and then 'include' it in any PHP files I'm making for the current project.
A lot of people will simply put in:
header("Access-Control-Allow-Origin: *");
which allows anyone and everyone to access the php file. Since this is for a game and people will find ways to cheat/hack, this solution keeps that under control while allowing it to be expandable to more than one requester.
The Allow-Methods describe what the AJAX requester can or cannot do. In my example, they can GET. You can find other options here:
developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Allow-Methods
Another thing it does is creates a small txt file in the same directory with the URI of the last request that came in. That way, you can test it from different sources and see what the origin is.
error_reporting(-1); // reports all errors
ini_set("display_errors", "1"); // shows all errors
ini_set("log_errors", 1);
ini_set("error_log", "php-error.log");
$http_origin = NULL;
if (array_key_exists('HTTP_ORIGIN', $_SERVER)) {
$http_origin = $_SERVER['HTTP_ORIGIN'];
} else if (array_key_exists('HTTP_REFERER', $_SERVER)) {
$http_origin = $_SERVER['HTTP_REFERER'];
} else {
$http_origin = $_SERVER['REMOTE_ADDR'];
}
$myfile = fopen("origin.txt", "w") or die("Unable to open file!");
$txt = $http_origin;
fwrite($myfile, $txt);
fclose($myfile);
//No origin found, die gracefully
if (!isset($http_origin)) {
die();
}
if ($http_origin == "https://preview.construct.net" || $http_origin == "https://www.mywebsite.com") {
header("Access-Control-Allow-Origin: $http_origin");
header('Access-Control-Allow-Methods: "GET"');
}
One of the handiest things you can do when working with AJAX is to run in debug mode and keep watch on the Ajax.lastdata. That will show you the last information sent back by the website you're making requests to.
Ajax and CORS is designed to limit who has access to the PHP file. If you're going to be transferring data via GET or POST, and then stuffing it into MySQL, which is very susceptible to injection and cross site scripting, you really want to know and limit who's accessing that PHP file.
A quote to live by:
"Writing software is easy. Making it idiot proof is nearly impossible."