Pleease Hep..

Jorjelu

Hello, i have a few questions.
1) I have a form on a page that "posts" data to another php page. When the user presses submit, he will be automatically redirercted to the php page. Is there any security problem over here (i have some passwords stored on the php file that help me connect to the database to insert the form information.) Can the user view somehow the php source?

2) Can i submit a form and redirect the user to another page that the one mentioned in action="page.php"?

drew010

there is no way they will be able to view the php source so you are safe. if you want to use a hidden field to redirect the user to, you will have to put code to do that in the file that gets posted to.

and in the script that gets posted, you can do something like this (and make sure you do it before anything is output to the browser, or else the header function wont work.)

if (isset($POST['redirect'])) {
header("Location: $POST['redirect']");
}

Jorjelu

10x very much. GOOD LUCK

Jorjelu

Originally posted by drew010

if (isset($POST['redirect'])) {
header("Location: $POST['redirect']");
}

what does this do exactly.. sorry for wasting your time 🙁

drew010

it checks to see if the hidden field called redirect exists, and if it does, it then forwards to whatever url you put in the value part of the redirect field.

so in plain english it is like,

if the form field 'redirect' is set then
forward the user to whatever url was in the value.

Jorjelu

but isn't it it intially set? .. <input type="hidden" name='redirect" value="http://yoursite.com/page.php"> i mean the value... Let me get it clear... this input.. i will put it toghether with the other inputs from the form? And the other code in the page i used for method="post"???

TheDefender

Sure, it's set with the form hidden field, but this is a way to make sure the code doesn't get run in a rogue manner by someone trying to pass it in a GET routine for example...

Let me get it clear... this input.. i will put it toghether with the other inputs from the form? And the other code in the page i used for method="post"???

Yes, this is exactly what you will do.

Jorjelu

hmm well i recieve the error:

Parse error: parse error, unexpected T_ENCAPSED_AND_WHITESPACE, expecting T_STRING or T_VARIABLE or T_NUM_STRING in /home/jmonnet/public_html/data/database.php on line 17

and on line 17 i have

header("Location: $_POST['redirect']");

from

if (isset($POST['redirect'])) {
header("Location: $POST['redirect']");
}

You see i have to pages.. here is the one with the form:

And here is database.php:

$nume=$POST['nume'];
$prenume=$POST['prenume'];
$username="jmonnet_test";
$password="*******";
$database="jmonnet_test";

mysql_connect(localhost,$username,$password);
@mysql_select_db($database) or die( "Unable to select database");
$query = "INSERT INTO tabel VALUES ('','$nume','$prenume')";
mysql_query($query);

mysql_close();

if (isset($POST['redirect'])) {
header("Location: $POST['redirect']");
}

🙂 🙂 what to do..?

Jorjelu

Heelp pleasee pleasee i promise this will be my last reply..!

spighita

header("Location: ".$_POST['redirect']);

See if that helps

Jorjelu

Nope i still recieve the error.. 10x anyway.

drew010

i think the problem is here:
mysql_connect(localhost,$username,$password);
localhost must be quoted like so:
mysql_connect("localhost",$username,$password);

Jorjelu

but it works that way.. is it ok to use a java redirect script?

drew010

that works too in the form action page, but not for those with javascript disabled. so if you do use that method, make sure you provide a link as well.