How to use a POST header to transmit variables?

[hihp]

Okay, following problem:

When a user hits submit on a form, I want to call a php script that processes the data entered in said form and makes some changes to a mySQL database. So far so good; I managed to do that.

However, then I want to call the same script again, just with a certain variable set to a certain value.

Reason is that I only use this one script file for all functions by setting a variable called "useraction" to a certain value, like "subscribe" or "unsubscribe". This is nromally done with mini-forms only containing a sumbit button and a hidden input tag bearing "useraction" as the name and "subscribe" etc. as the value.

problem is: how do I code it in PHP with headers that I can use the POST method to transmit such a variable?

To make that clear:
1. user clicks on form, which is submitted
2. script is called with "useraction" set to "subscribe"
3. script processes form information and makes database changes
4. script calls itself with "useraction" set to "showlist"

My attempt so far was this:

$data = urlencode("useraction")."=".urlencode("showlist")."&";

$header = "Location: POST http://www.domain.tld/user/action.php HTTP/1.0\n";
$header .= "Host: www.domain.tld\n";
$header .= "Content-type: application/x-www-form-urlencoded\n";
$header .= "Content-length: " . strlen($data) . "\n";
$header .= "\n".$data;

header($header);

Can anybody help me? I've tried to understand the RFC2616 about the HTTP protocol, but it's too complicated for me.

Any input would be appreciated, thanks.

[Weedpacket]

Well, you don't say what happens, so I'll just point out that what you've posted will give parse errors because of the unescaped quotes in your $header="Location: POST..." line.

I'll also point out that an HTTP POST header looks like:

POST [url]http://www.example.com/page.php[/url] HTTP/1.0

(see RFC2616, section 5.1.2 for an example of a request line, using GET instead of POST.)

Then a "\r\n", maybe followed by other header lines, each ending with "\r\n", then another "\r\n" to separate the header from the body.

And what RFC2616 calls the "Request-URI" doesn't contain HTML. Different things, HTTP and HTML; entirely different layerss of the ISO-model protocol stack.

[hihp]

Originally posted by Weedpacket
Well, you don't say what happens, so I'll just point out that what you've posted will give parse errors because of the unescaped quotes in your $header="Location: POST..." line.

Oh, I'm sorry... of course I don't have a code as stupid as the one you saw... I forgot to turn the option off that looks through the posting and turns all links into real urls (but as the stuff sits inside probably PRE-Tags, you can see the link stuff).

The way it is now is my attempt. Even with your "\r" addition, it doesn't work.

Well... so what doesn't work is that just no reload happens.

[ranam]

Why not just use GET method?? That would be much easier. Or you could just use something like:

<?php

if($action=="subscribe")
	{
	$db = mysql_connect("localhost", "root","");
	mysql_select_db("dbname",$db);
	$sql = "INSERT INTO subscribers (fields) VALUES ('$values')";
	$result = mysql_query($sql);
	$action="show";
	}
if($action=="show")
	{
	$db = mysql_connect("localhost", "root","");
	mysql_select_db("learndb",$db);
	$result = mysql_query("SELECT * FROM subscribers",$db);
	while($myrow = mysql_fetch_array($result))
		{
		//show the stuff
		}
	}
else
	{
	?>
	<form method="post" action="<?php echo $PHP_SELF?>">
	<input type=hidden name=action value="subscribe">
	E-mail:<input type="Text" name="email"><br>
	<input type="Submit" name="submit" value="Enter information"></form>
	<?
	}
?>

This is much easier ofcourse.

[hihp]

Originally posted by ranam
Why not just use GET method?? That would be much easier.

Because I don't want anything to show up in the address line and also don't want to enable people messing around with the script or maybe even accidentally bookmarking a link with such actions in it.

Your other suggestion is pretty good though. Nevertheless, I'm still interested in getting this whole POST thing correct.

[Weedpacket]

Originally posted by hihp
I forgot to turn the option off that looks through the posting and turns all links into real urls (but as the stuff sits inside probably PRE-Tags, you can see the link stuff).

My apologies; I've had trouble with regexps-with-things-that-look-like-smilies-inside-code-tags myself. It looks odd to have a two-line post with "edited by Weedpacket on ..." at the bottom.

I'm feeling a bit silly asking this, but did you drop the "Location: " part?

I'm also wondering if using header() will break things. Off-hand, I don't see why it should, but perhaps a more robust approach would be to use fsockopen() to open a socket connection to www.domain.tld, and fwrite() the request to it. You can then fread() any response the server makes and react appropraitely, if you wish.

Drat, gotta turn that pasrse-urls-as-links bit off again; please Mr. forum, can we have that done permanently?

[hihp]

Hmmm... you see, I'm well-wnough-versed in general PHP stuff, but I'm not too good in the whole Socks stuff, meaning I've got no idea how to do what you suggested :-)

But yes, I tried to drop the Location part, tried it both with and without it. <sigh> I'll probably just try it some other way...

[Weedpacket]

Oh, it's simple enough; there's sample code in the manual. You've already done most of the work building up the request.

fsockopen() works pretty much the same way as fopen(). fwrite() and fread() behave the same way as with files.

Roughly:

1. $socket=fsockopen(domain,port)

2. fwrite($socket,$request);

3. $response=fread($socket);

4. fclose($socket);

And we're all home in time for tea and cake.

[mdkexec]

Hey there,

I was looking for a similar thing, but alas there is no way to do EXACTLY what you wanted.

The thing is, when you send info using header() it is sending an http header to the client browser. When you fill in the location field, it is telling the browser to make a GET style request to the specified location. All the other fields that you sent get disregarded when the client browser makes that GET.

What your code is trying to do is essentially attempt to post information to the client's web browser and then instruct the browser to GET information from the URL indicated by location...so no dice.

The solution mentioned by Weedpacket can be found at http://www.zend.com/zend/spotlight/mimocsumissions.php?days=10000&f_id=mimocsumissions&mode=&kind=sl&article=mimocsumissions

The downside of that solution is that it makes it look like you have moved on to the "posted" page by displaying the contents of that page, but you actually never move from the page you are on...this could be problematic when using things like PHP_SELF.

The best advice is to use session variables if you don't want people to be able to mess with the variables you are passing. In reality even post variables can be faked by the clients. Of course there are times when it would be convienient to use posted variables, but you can always work around it using sessions

You can find more info about the location, http header fields and the http protocol in general here:
http://www.w3.org/Protocols/rfc2616...4.html#sec14.30

[peterv]

I had a similar problem, couldn't get POST headers to work.

I use a workaround with javascript

<script>
javascript:form.Field.value='SHOW';
form.submit();
</script>

Write this to your output after the SQL processing and the page is resubmitted with the new value.

Hope this helps