form verification problem

doobster

Hello I have a form that uses the following syntax for the submit button.

in my script if i use if (isset($HTTP_POST_VARS['submit']))

it does not work although i clicked on the image.

I cant use $_POST because my php does not support it but that should not make a dif.

any suggestions?

chrima

Just use an hidden input field called "submit"

Cheers,
chrima

doobster

that wont work. i am doing this to make sure ppl are clicking on the image and not fabricating a fake form.

cosminb

if you want to see if your form was submited you can also use just:
if($HTTP_POST_VARS)
{
....
}
this will evaluate to true if $HTTP_POST_VARS is not null

laserlight

cosminb's method might result in an undefined variable notice, depending on what your error level is set to.

Perhaps try empty() instead of isset()

Actually, people still can create a fake form with a submit button having the same name as your image.

cosminb

Any security advisor will tell to limit your error reporting to 1(E_ERROR).

error_reporting(E_ALL) should be use only in the development faze

laserlight

Not good, I cant seem to get the image submit button to return any value when the form is submitted.
You can keep the submit button, but you'll have to use some other method of checking if the form is submitted.

"error_reporting(E_ALL) should be use only in the development faze"
That's true most of the time, but I should also add that it does imply that your use of the variable without checking if not quite correct, though may work.
After all, one should get things right (or at least appear right) in development phase then release it.

cosminb

I didn't say anything about not checking every variable that the users submits.
i only sugested to use
if ($POST)
instead of
if (is_set($POST['submit']))
what variables are checked after that depends on the developer.