views:

32

answers:

3

I'd like my form to include a certain value if the quantity is equal to 1 (via a text box).

I've managed to show what the total cost is using JavaScript and I could submit it with this value but I'm worried that when JavaScript is turned off the user will be able to submit the form without the extra fee being added. Therefor escaping the fee.

<form>
    <label>Qunatity</label>
    <input type="text" name="qyt" />
    <input type="text" name="fee" value="250" />

    <div class="total">[whatever the total is]</div>

    <input type="submit" value="submit" />
</form>

Is there a way I can submit this form so that it submits 250 only if a quantity of 1 is added to the form? I'd like to avoid using a select input.

Will I need to split my form out into two stages to achieve this?

+3  A: 

You need to check your logic in server-side code.

Most people have Javascript enabled, so you should do it in Javascript to provide a better experience, but you must always reproduce the logic on the server.

SLaks
Indeed; relying exclusively on JavaScript for validation is technically a security vulnerability. Take note that any script kid can still open up TelNet and start manually typing out HTTP, circumventing JS validation. JavaScript can add convenience and usability to your site, but don't rely on it.
LeguRi
Thanks. I was worried about relying on JavaScript because of these very reasons. How can achieve this logic with a text input field though? Will I need to submit the form first before I can work out the total?
Sevenupcan
You can still work out the total in JavaScript and show it to the user, just don't submit that total. Submit the quantity and fee values, then calculate the total again server-side.
Mark B
A: 

The best/safest way to handle this would be to do your total calculation on the server side. That way the data you store will always be correct.

Mark B
+1  A: 

If you need to validate your input without JavaScript, have a server-side component (PHP?) to do the job and return the same form with an error message if no quantity was given. That way you don't have to split your form into two steps.

Select0r