tags:

views:

37

answers:

4

I am trying to attach a numerical "post ID" value to comments so that they can be retrieved from the database and displayed in the proper place. How do I establish this numerical value within my html form as something that gets sent to the script that inserts it into the database? I assume I need to use GET or POST but I don't understand how to use those to send anything except text entered by the user.

This is the form I am using to send the "name" and "comment" inputs:

 <div class="comments">
 <form action="foxpost.php" method="post">

 <label for="name">Name</label><br>
 <input id="name" name="name" type="text" /><br>
 <label for="message">Comment</label><br>
 <textarea class="message" id="message" name="message"></textarea><br><br>

 <input type="Submit" value="Post Comment" />
 </form>
 </div>
A: 

Put the id in a hidden field in your form:

<input type="hidden" name="post_id" value="id_goes_here" />
mwittrock
@Jimmy: Just keep in mind that, although the field is hidden, users *can* change the value of hidden fields using tools such as [Firebug](http://getfirebug.com/).
Niels van der Rest
That is insecure. If you want to generate the id from php you should do it before sending the sql, when you parse the comment from $_POST and dinamically create a value, without exposing it to the browser.
vlad b.
The OP wants to pass the ID of the post, that the user is commenting on, back to the server, so that the comment can be stored with a reference to the post.
mwittrock
+1  A: 
vlad b.
If you're using MySQL it would be the mysql_insert_id() function, called right after the INSERT statement as outlined by @vlad above...http://us.php.net/manual/en/function.mysql-insert-id.php
Don
Thank you Don, forgot to mention that.
vlad b.
A: 

I would suggest to not have the ID as part of the form and just use your databases AUTO_INCREMENT feature.

pferate
+2  A: 

Since you tagged this question with PHP, I'm guessing thats the language your using for your back-end. Another assumption I'm making is that your actually formatting your request querystring with the postID, something like "http://example.com/posts.php?postID=1212", notice the postID in the querystring, you just pass that on, like this:

 <div class="comments">
 <form action="foxpost.php?postID=<%= $_GET['postID'] %>" method="post">

 <label for="name">Name</label><br>
 <input id="name" name="name" type="text" /><br>
 <label for="message">Comment</label><br>
 <textarea class="message" id="message" name="message"></textarea><br><br>

 <input type="Submit" value="Post Comment" />
 </form>
 </div>

Using

<%= $_GET['postID'] %>

will simply echo the postID from the querystring straight into the HTML, or you could assign it to a variable.

Timbermar