PHP Contact Form question $_POST, $_GET $_SESSION

Question

EDIT:

So my remaining questions are: (1) should I use a 302 or 303 for the header() redirect? I believe 303 is the proper way. (2) Is $_SESSION the best way to pass variables to the ?contact=thankyou page?

My revised code:

if ( isset( $_POST[ 'submit' ] ) )
{
  if ( is_bot() )
  {
    header( "Location: http://www.example.com/contact/?contact=thankyou",
        TRUE, 303 );
    exit;
  }
  elseif ( is_input_error() )
  {
    // show error form stuff...
  }
  else
  {
    contact_send_email();
    header( "Location: http://www.example.com/contact/?contact=thankyou",
        TRUE, 303 );
    exit;
  }
}

ORIGINAL (resolved):

I am just learning about $_POST, $_GET and forms with PHP. I have a Contact Form that started out simple, but has now become a little complicated for my experience.

// curly braces left out for brevity
if ( isset( $_POST[ 'submit' ] ) )
  if ( is_bot() )
    header( "Location: http://www.example.com/contact/?contact=thankyou", 
            TRUE, 303 );
  if ( is_input_error() )
    header( "Location: http://www.example.com/contact/?contact=error", 
            TRUE, 303 );
  else
    contact_send_email()
    header( "Location: http://www.example.com/contact/?contact=thankyou", 
            TRUE, 303 );

1. Being new at this, I guess I'd like to know if you see any glaring problems?
2. Does my header() redirect code look complete and valid?
3. What is the most common and/or recommended way to pass $_POST variables after the header() redirection? Is it with $_SESSION, or is there a better way? I've never used sessions before, so I am a little intimidated by them.

EDIT: By the way, I want to pass the header() redirect with $_GET to avoid the "refresh-resend" very scary and evil warning message.

Answer 1

1st question. I would suggest to use brackets { } after if, because your conditional blocks look invalid.

2nd question. I don't think you need 303 status code. A typical header('Location: ...'); will do.

As for 3rd question. Two possible solutions are: session or database.

To sum up, I'd do:

if ( isset( $_POST[ 'submit' ] ) )
{
  if ( is_bot() )
  {
    header( "Location: http://www.example.com/contact/?contact=thankyou" );
  }
  elseif ( is_input_error() )
  {
    header( "Location: http://www.example.com/contact/?contact=error" );
  }
  else
  {
    contact_send_email();
    header( "Location: http://www.example.com/contact/?contact=thankyou" );
  }
}

Answer 2

Being new at this, I guess I'd like to know if you see any glaring problems?

I don’t know if you intended it, but your code reads translated into a version with curly braces like this:

if (isset($_POST['submit'])) {
    if (is_bot()) {
        header("Location: http://www.example.com/contact/?contact=thankyou", TRUE, 303);
    }
}
if (is_input_error()) {
    header("Location: http://www.example.com/contact/?contact=error", TRUE, 303);
} else {
    contact_send_email();
}
header("Location: http://www.example.com/contact/?contact=thankyou", TRUE, 303);

If the curly braces are missing, the body of a if block is always just the next statement. And I doubt you really want that.

Does my header() redirect code look complete and valid?

I would add an exit after each header to prevent further code of being executed. But the rest looks fine.

Answer 3

Remove the 303 from the header function. It is a 302, temporary redirect you want, which the function uses by default if you don't explicitly set one.

A small point, but worth noting; choosing the wrong HTTP redirect status code will upset SEO very slightly.

Answer 4

I dont see why you want to redirect to those error or thank you pages.

On error: display the form again with the values submitted, highlight the fields with erroneous or missing required fields.

On success: display the thank you html page.