ansaurus

Question

PHP form question.

Answer 1

A:

Revised:

    <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
  <title>Order Form</title>
  <meta http-equiv="content-type" content="text/html;charset=UTF-8" />
</head>
<body>

<form name="orderform" method="get" action="ProcessOrder.php">
<p>Name<br/>
<input type="text" name="name" size="50" value="<?php echo(htmlspecialchars ($_GET['name'])); ?>/><br/>
<p>Address<br/>
<input type="text" name="address" size="50"value="<?php echo(htmlspecialchars ($_GET['address'])); ?> /><br/>
<p>City<br/>
<input type="text" name="city" size="50" value="<?php echo(htmlspecialchars ($_GET['city'])); ?>/><br/>
<p>Province<br/>
<input type="text" name="province" size="2" value="<?php echo(htmlspecialchars ($_GET['province'])); ?>/><br/>
<p>Postal Code<br/>
<input type="text" name="postalcode" size="6" value="<?php echo(htmlspecialchars ($_GET['postalcode'])); ?>/><br/>
<p>Email<br/>
<input type="reset"/>
<input type="submit"/><p>
</form>
</body>
</html>

EDIT: Sorry realized you were using GET not POST.

jaywon 2009-11-18 04:14:48

1) The form is GET, not POST; 2) XSS vunerabilities are present; 3) Will cause a (notice, error, warning? not sure which one).

MiffTheFox 2009-11-18 04:16:45

Don't forget to sanitize your input. Also this isn't allowed on file upload elements.

AverageAdam 2009-11-18 04:19:35

had already noticed the GET before your comment! updated for xss. was just trying to show him a quick example, but agree that should be part of the solution.

jaywon 2009-11-18 04:22:30

Answer 2

+3 A:

For each field, do something like this:

<input type="text" name="name" size="50" value="<?php print isset($_GET["name"]) ? htmlspecialchars($_GET["name"]) : ""; ?>" /><br/>

MiffTheFox 2009-11-18 04:15:52

You want the isset() and the htmlspecialchars() which the other examples don't have.

Dave 2009-11-18 04:18:46

Answer 3

A:

The PHP manual has a great tutorial on how to work with forms in PHP

<form action="action.php" method="post">
 <p>Your name: <input type="text" name="name" /></p>
 <p>Your age: <input type="text" name="age" /></p>
 <p><input type="submit" /></p>
</form>

Hi <?php echo htmlspecialchars($_POST['name']); ?>.
You are <?php echo (int)$_POST['age']; ?> years old.

A sample output of this script may be:

Hi Joe. You are 22 years old.

Ólafur Waage 2009-11-18 04:17:03

Answer 4

+1 A:

I usually use something like this for simple forms/sites without a framework.

$name       = isset($_GET['name'])       ? trim($_GET['name'])       : "";
$address    = isset($_GET['address'])    ? trim($_GET['address'])    : "";
$city       = isset($_GET['city'])       ? trim($_GET['city'])       : "";
$province   = isset($_GET['province'])   ? trim($_GET['province'])   : "";
$postalcode = isset($_GET['postalcode']) ? trim($_GET['postalcode']) : "";

...

<p>Name<br/>
<input type="text" name="name" size="50" value="<?= htmlspecialchars($name); ?>" /><br/>
<p>Address<br/>
<input type="text" name="address" size="50" value="<?= htmlspecialchars($address); ?>" /><br/>
<p>City<br/>
<input type="text" name="city" size="50" value="<?= htmlspecialchars($city); ?>" /><br/>
<p>Province<br/>
<input type="text" name="province" size="2" value="<?= htmlspecialchars($province); ?>" /><br/>
<p>Postal Code<br/>
<input type="text" name="postalcode" size="6" value="<?= htmlspecialchars($postalcode); ?>" />

This allows you to set default values if you need to, or you can just leave them blank.

Or you can do the following*

$fields = array(
    'name'       => '', 
    'address'    => '', 
    'city'       => '', 
    'provice'    => 'Quebec', 
    'postalcode' => ''
);

foreach ( $fields as $field => $default ) {
    $$field = isset($_GET[$field]) ? trim($_GET[$field]) : $default;
}

And the HTML remains the same.

* No, I didn't test this.

Justin Johnson 2009-11-18 04:23:56

ansaurus

tags:

views:

answers:

PHP form question.

related questions