Can a XML-RPC request be made from an html form?

Question

I'm playing with a new service's very simple API and I'm just curious if its possible to send an xml-rpc request directly from an html form. The api request example is this:

<?xml version="1.0"?>
<methodCall>
<methodName>send</methodName>
    <params>
        <param><value><string>YOUR_API_KEY</string></value></param>
        <param><value><string>[email protected]</string></value></param>
        <param><value><string>5551231234</string></value></param>
        <param><value><string>Test Message from PENNY SMS</string></value></param>
    </params>
</methodCall>

And my current form iteration is this:

    <form method="POST" enctype="text/xml" action="http://api.pennysms.com/xmlrpc"&gt;

            <input type="hidden" name="api_key" value="MYAPIKEY"/>

            <label for="from">From</label>
            <input type="input" name="from" value=""/>

            <label for="phone">Phone</label>
            <input type="input" name="phone" value=""/>

            <label for="text">Text message</label>
            <input type="input" name="text" value="">

            <input type="submit" value="Send"/>

    </form>

Answer 1

Not without involving either Javascript or server code. The "enc-type" attribute specifies the format that the form data is sent to the server in, and unfortunately "xml-rpc" isn't in the list of accepted formats :)

Answer 2

No, this is not possible from plain HTML. The only standard encodings for submitting form data are application/x-www-form-urlencoded and multipart/form-data.

You can do this from JavaScript using an XMLHTTPRequest, though only to APIs on the same domain that the HTML came from. After a quick Google search, I found this AJAX XML-RPC client, though I've never used it so I can't vouch for it.

Answer 3

That might depend if the server is actually enforcing the enctype

For example using the technique shown here http://pentestmonkey.net/blog/csrf-xml-post-request you can do cross-site posts of XML POST data.