Convert simple Javascript script to PHP

Question

I have a simple javascript function to validate a form (RSform!Pro in Joomla) on submit. Problem is bots are able to submit the form without the validate script running when they have javascript disabled. The only option I can think of to prevent this case from happening is to use php instead of javascript. Could someone help me with this conversion or offer an alternative?

    function validateEntreeCount(theForm)
    {
     if (parseInt(document.getElementById('Attendees').value) != 
parseInt(document.getElementById('Beef').value) + 
parseInt(document.getElementById('Chicken').value) + 
parseInt(document.getElementById('Vegetarian').value))
     {
      alert('The total amount of attendees does not match the total amount of entrees selected'); 
      return false;
     } 
     else
     {
      return true; 
     }
    }

Thanks for everybody's input!

Answer 1

I cannot help with the conversion right now, but to deal with bots you can also hide the submit button from users and use javascript to include it in the page.

Answer 2

You will have to find where in the code the form is getting submitted. But it is not the id of an element that it gets submitted, but the name.
In php you are looking for $_GET['name of element'], and $_POST['name of element in post request']
When you have the string result you can use intval('') to convert to an int

Answer 3

I would say it is always a good idea to have validation both on the client side (with javascript) AND on the server side (with whatever you use).

This way, you make sure the user doesn't have to wait for a page reload if he made a mistake, but you can be sure that your app won't have invalid input because your user does not have javascript on, maliciously or not (many users don't leave javascript on by default).

I guess the buzzword here is graceful degradation. I mean that it should be possible to use your website without javascript on, even if not having as good a experience as if you had it on. And forms are a no brainer for that, specially because of the importance of cleaning the data before you can really use it.

Answer 4

You can go something like this:

function validateEntreeCount()
{
 if (intval($_POST['Attendees']) != 
intval($_POST['Beef']) . 
intval($_POST['Chicken']) . 
intval($_POST['Vegetarian']))
 {
  print('The total amount of attendees does not match the total amount of entrees selected'); 
  // exit/redirect/return false or whatever
 } 
 else
 {
  return true; 
 }
}

You make sure that values in POST var are coming there. and also if you are comparing numbers then you will have to specify + rather than a dot as shown above.

Answer 5

In order for the conversion to work, I will have to assume a few things, so let me show you a conversion with my general assumptions:

My assumed HTML page, containing a form with a few input types, total number of attendees, a number indicating how many orders of what type of dinner and a submit button. Notice the method of the form is a post and the action is yourfile.php.

<form name="my_form" method="post" action="yourfile.php">
   <input type="text" value="Attendees"></input>
   <input type="text" value="Beef"></input>
   <input type="text" value="Chicken"></input>
   <input type="text" value="Vegetarian"></input>
   <input type="submit" value="submit"></input>
</form>

Your PHP page that will retrieve the form values:

<?php
  function validateEntreeCount() {
   // used for validation purposes
   if (!isset($_POST['submit']) {
       // form was submitted without data, silly bots.
     echo "We've encountered a problem, please re-enter your data";
      // possible redirect back to the page.
   }       
   // convert the data into integers.
   $total   = intval($_POST["Attendees"]);
   $beef    = intval($_POST["Beef"]);
   $chicken = intval($_POST["Chicken"]);
   $veg     = intval($_POST["Vegetarian"]);

    // if all is well, everything should be equal
     if ($total == ($beef + $chicken + $veg)) {
       return true;
    }  
   // something went wrong
       echo "The total amount of attendees does not match the total amount of entrees selected";
       return false;
  }
?>

This hasn't been tested or compiled, just demonstrating how the comparison function would look like in PHP. There are many things to work on, especially validating input and error checking.

Hope this helps you out, or points you in the right direction.