Force POST on redirect

baseline

Okay, I admit it, I'm new to this thing called PHP. I have a small question. Any help would be greatly appreciated.

I have an html page with a form that submits itself to a purely php page (no html). This processess the request and redirects you to 2 possible pages. I've figured out how to do the redirect using header and "Location: " but my question concerns the parameters in the url.

The url I forward to contains some parameters. By default, using header with Location and "page.php?foo=bar", the request is sent using GET. Is there a way I can modify the redirect header to force a POST? Is this even possible?

I know I can resolve this by changing the page with the form by adding PHP and making it submit the form back to itself and process the form (as the method is POST). However, this requires me to put some PHP code before the <html> tag (to allow for the redirect). This is a problem because the program the web designer uses to edit the page, GoLive (on a mac, don't know which version), has a nasty tendancy of chopping out anything that precides the <html> tag. Suffice to say, this is extremely frustrating.

Help? 😕

Any solution or alternate paths of investigation would result in my eternal gratitude. (Not much, I know, but I'm a young and poor programmer and am just happy to have a job).

Many thanks,
baseline

mykg4orce

if you mean making the form submit it self on a redirect then you could try using Javascript:

document.form1.action = "go.php?var=mobo"; 
document.form1.submit();

baseline

That's Javascript isn't it?

No, that's not quite what I meant. It's more like this:

Page A submits a form to Page B which processess the form data. Page B, which is purely php, after processing the data redirects the user to either Page C or Page D. This is done using something like this:

header("Location: http://www.somehwere.com/pageC.php?foo=bar");

When you get to page C or D, the the user is able to see the full url including the "?foo=bar" portion. I don't want them to see this. I want the data to be done via a POST, instead of GET so the parameters are not visible in the url. POST will also allow more data to be transmitted.

My question is, can the header statement be modified (or another header added) such that the redirect works as a POST and the parameters are not visible. (I.E. add another statement like header("Method: POST")). Is there a way to make the redirect act as if it was submitting another form using POST as opposed to simply sending the full url to the browser?

Thanks though!
baseline

mykg4orce

well you can't modify the header(); function but you could set the var '$foo' to the session and have the Page C or D check if ($foo == "") { } else { echo "doo stuff"; }

🙂

baseline

Session variables! I would never have thought of that (partially because I don't really know much about them!).

That'll do very nicely. Many thanks!

baseline

pnoeric

--you can also do a manual post using the cURL library or even just a bit of code to fake a POST (I've seen them zend.com and used one in some library I wrote around here someplace) ...those will post and return the resulting HTML to your code, which you can turn around and echo back to the browser.

ah, there is one weird side effect, though. (isn't there always one weird side effect?) the address field will be the URL of page B, not C or D, but you will be displaying the contents of C or D in the browser window.

best
Eric

mdkexec

Hey there,

I was looking for a similar thing, but alas there is no way to do EXACTLY what you wanted.

The thing is, when you send info using header() it is sending an http header to the client browser. When you fill in the location field, it is telling the browser to make a GET style request to the specified location. All the other fields that you sent get disregarded when the client browser makes that GET.

What your code is trying to do is essentially attempt to post information to the client's web browser and then instruct the browser to GET information from the URL indicated by location...so no dice.

The solution mentioned by pnoeric can be found at http://www.zend.com/zend/spotlight/mimocsumissions.php?days=10000&f_id=mimocsumissions&mode=&kind=sl&article=mimocsumissions

The downside of that solution is that it makes it look like you have moved on to the "posted" page by displaying the contents of that page, but you actually never move from the page you are on...this could be problematic when using things like PHP_SELF.

The best advice is to use session variables if you don't want people to be able to mess with the variables you are passing. In reality even post variables can be faked by the clients. Of course there are times when it would be convienient to use posted variables, but you can always work around it using sessions

You can find more info about the location, http header fields and the http protocol in general here:
http://www.w3.org/Protocols/rfc2616/rfc2616-sec14.html#sec14.30

MrAlaska

Storing the variables on the server, either through sessions variables or on your own would do the trick. Personally, I tend to avoid header redirects at all. There is almost always a way to use 'includes' thereby never losing your handle on the variables, but it might mean restructuring your existing templates to accomodate that method.

If you want to force a transparent post, Snoopy has a pretty spiffy library at your disposal:
http://sourceforge.net/projects/snoopy/

Garbett

I've got a method working that forward's posted variables on a redirect. This also makes sure that the history of the browser is controlled.

I used the following Andy's method in Perl as an example and modified it to work in PHP.

So far it's working great.

<?php

session_start();

// If a token is not specified, then forward we go
if(!$token)
{
  $token  = time();
  $action = "FORWARD";
}

// Action is set, so it's either forwarding or posted
if($action)
{
  // Transmit posted information via a session variable, $post
  session_register('post');
  reset($_POST);
  while(list($key,$value)=each($_POST))
  {
    $post[$key]=$value;
  }

  // Determine method based on HTTP protocol for forwarding
  if(strcmp($_SERVER['SERVER_PROTOCOL'], "HTTP/1.0") > 0)
  {
    header("Status: 303 See Other");
  }
  else
  {
    header("Status: 302 Temporarily Moved");
  }

  // This will need modification for scripts that already have GET parameters
  $forward = $_SERVER["SCRIPT_NAME"] . "/?token=" . $token;

  // Here we go
  header("Location: " . $forward);
  header("Content-type: text/html");

  // Little reference in case of failure....
  echo "<HTML><HEAD>\n";
  echo "  <meta HTTP-EQUIV=\"Refresh\" CONTENT=\"300; " . 
         "URL=ncate_logout.php\"/>\n";
  echo "  <meta HTTP-EQUIV=\"Pragma\" CONTENT=\"no-cache\">\n";
  echo "  <meta HTTP-EQUIV=\"Expires\" CONTENT=\"-1\">\n";

  echo "</HEAD><BODY>\n";
  echo "  Go <A HREF=\"" . $forward . "\">here</A>\n";
  echo "</HTML></BODY>\n";
  exit (1);
}

// It all fell through, continue with normal page construction

header("Content-type: text/html");
header("Pragma: no-cache");

// Restore the posted variables...
if(isset($post))
{
  reset($post);
  while(list($key,$value)=each($post))
  {
    $$key=$value;
  }
}
session_unregister('post');

echo "<HTML>\n";
echo "  <HEAD><TITLE>token=$token</TITLE></HEAD>\n";
echo "  <BODY>\n";
echo "    <H1>$tryme</H1>\n";
echo "    <FORM ACTION=\"".$_SERVER["SCRIPT_NAME"]."/\""." METHOD=\"POST\">\n";
echo "      <INPUT TYPE=\"hidden\" name=\"action\" value=\"post\"/>\n";
echo "      <INPUT TYPE=\"hidden\" name=\"token\" value=\"$token\"/>\n";
echo "      <INPUT TYPE=\"text\" name=\"tryme\" value=\"$tryme\"\>\n";
echo "      <H1><INPUT TYPE=\"submit\" VALUE=\"METHOD=POST\"></H1>";
echo "    </FORM>\n";
echo "  </BODY>\n";
echo "</HTML>\n"

?>

mykg4orce

halarious! this post is so old. Good to see people still interested in this 😛

Garbett

I actually did a search before posting something new :p

Garbett

I added GET variables to the script I'm using, by duplicating the POST sections but using $_GET.

I also made it generic for actual use. All of the code except the HTML generation is in a file that I make the last require_once in a PHP file that generates the form. I also removed the session_start, since that is handled in a seperate user validation script.