GET, POST, Multi-Selects and the PHP nightmare

theauthor

When the HTML of a form has a field name 'choices' and has five checkboxes with that name, each with a different value, like this:

<form name="testform" action="processor.php" method="post">
<input type="checkbox" name="choices" value="One">One
<input type="checkbox" name="choices" value="Two">Two
<input type="checkbox" name="choices" value="Three">Three
<input type="checkbox" name="choices" value="Four">Four
<input type="checkbox" name="choices" value="Five">Five
<input type="submit" value="submit" name="submit">
</form>

In PHP, without altering the HTML at all (assume that I have no control over the HTML because there will be remote forms already coded by others that submit to this script) if I look at the values through the PHP-approved method (assuming that every checkbox was checked by the user), I see:

<?php
$choicevalues=$_POST['choices'];
echo $choicevalues; //prints 'One'
?>

Where did the rest of my selections disappear to? How can I get at them? This is the question that is plaguing me.

As a minor additional frustration, what if I don't give a durn what action the form used?
Is there no axiomatic way to access the form variable regardless of method (without turning on the globals option)?

vaaaska

You won't get the boxes that aren't checked...

So, you'll need to check all of them...and then assign either the '1' you get back or '0' since it doesn't exist.

RossC0

True - The HTTP Response to the server will contain only check boxes that are checked!

Also if you have two items returned with the same name (as you have) it will overwrite the variable when adding it to the $_POST array.

What you need to ensure you get an array back. This is done by adding a [] to the end of the form elements.

So should be like so:

<form name="testform" action="processor.php" method="post">
<input type="checkbox" name="choices[]" value="One">One
<input type="checkbox" name="choices[]" value="Two">Two
<input type="checkbox" name="choices[]" value="Three">Three
<input type="checkbox" name="choices[]" value="Four">Four
<input type="checkbox" name="choices[]" value="Five">Five
<input type="submit" value="submit" name="submit">
</form>

The your php should be like:

<?php
$choicevalues=$_POST['choices'];
print_r($choicevalues);
?>

theauthor

Did either of you even bother to read my post?

#1: I specified that ALL FORM ELEMENTS WERE CHECKED

#2: I specified that THE HTML CANNOT BE CHANGED FOR REASONS BEYOND MY CONTROL

I'm not a programming or php newbie. I know about the [] idiocy of php. I'm in a situation in which I can't use it because I don't control the forms.

So I said to myself, "It can't be true. Surely no programming language would be so poorly designed that it would actually require me to change the name of a variable in ANOTHER language/program whose variables it is importing."

"No it's true!" proclaimed my fellow programmers.

"But," I cried, "The external program actually provides the variables in the format that I want them, as a comma-separated list."

"So what," they said, "PHP won't let you get at that comma separated list no matter what you do. You'll have to rename the form elements in the HTML and then get the data as an array, and then recreate the comma separated list that was what you originally needed yourself."

"That's not acceptable" I said.

"Well, you could write an input handler from scratch." they replied.

"That's not acceptable either" I said. "Any web language worth ANYTHING will have a way for me to access the data that the web server sent me in the format that the web server sent it to me."

"Nope. It can't be done" said every PHP programmer I knew.

I whined, "Fine! I'll ask some other PHP programmers. Surely they'll know the secret."

So I posted to a bbs for php programming help, hoping and praying that I wouldn't get the same old tired response: "PHP is a crippled POS language that won't let you do the very simple thing you want to do without going through a bunch of extremely complex shenanigans."

RossC0

Now now don't throw your toys out of the pram...

I'm sorry thought you were a newbie to php with your 1 post... Mind you your rant hasn't improved this perception - have you checked the forums FAQs terms and conditions?

PHP is like any language you have to operate within the terms of the language...

Personally if I were you I would ask the person who controls the forms to make the change - especially as they must have done it to set the action to be your php page!

theauthor

Originally posted by RossC0
Now now don't throw your toys out of the pram...

Wah, Wah, but daddy my toys are broken!

I'm sorry thought you were a newbie to php with your 1 post...

Newbie to phpbuilder doesn't equal newbie to php or newbie to programming. However I didn't blame you for assuming that. I simply informed you so that you would be aware that my post probably did contain all the information necessary to answer the question (rather than just providing the first newbie-bait answer that you might assume was necessary from glancing only at the title of the post). I did however forget to thank you for taking the time to respond. Even though your answer wasn't what I was looking for, it is people like you who regularly answer posts that make forums like these so valuable. I'm a newbie to the board only because every other time I've come here with a question, a thorough search revealed that it had already been answered and so I had no need to join.

Mind you your rant hasn't improved this perception

That creative rhetoric is not something that a newbie would be likely to come up with (nor would a newbie be likely to care about such a thing). I was attempting to be humorous while still expressing my frustration, without ranting in the useless and infantile way that you suggest that I was.

I provided within the context of my 'rant' additional information that sheds light on the question at hand (namely that HTTP GET's and POST's provide the values of multi-selects et. al. via a comma seperated list in the first place and that it is in fact that comma separated list that I am after and also that I was aware of at least two alternatives solution that would get me where I wanted to go, one that would require me to have other people change there code and one that would require me to delve fairly deeply into the internals of PHP to determine if it was even possible)
Has the stdin already been slurped by php or can it be accessed programatically, I wonder?

- have you checked the forums FAQs terms and conditions?

Yes. Do you believe that I have violated them?

PHP is like any language you have to operate within the terms of the language...

PHP is unlike any other language in that it requires you to change the syntax of a separate language in order for it to function properly.

Personally if I were you I would ask the person who controls the forms to make the change - especially as they must have done it to set the action to be your php page!

Personally if you were me you would lose the contract.

vaaaska

I have a better answer for you but I don't feel like helping you anymore after all of that.

And besides, I think that even for a newb the answer is pretty evident.

Good luck...

theauthor

Originally posted by vaaaska
I have a better answer for you but I don't feel like helping you anymore after all of that.

All of what? Suggesting that you didn't read my OP very carefully? I admit that I failed to thank you for your initial response, a bad failure of ettiquet(sp) on my part, and you certainly are not obligated to help me. So let me now, after the fact, say "Thank you for your response" I know that it was given in a spirit of friendliness and helpfulness. I'm sorry if my response seemed more critical than was fair.

And besides, I think that even for a newb the answer is pretty evident.

The answer that what I want to do is impossible given the constraints specified? You're right it's obvious. But I had hoped that there was another way that I just had never managed to stumble across. Hence the post. However I get the feeling that you mean that you have a solution to the problem rather than merely an answer. I don't believe you.

Good luck...

Good luck to you as well. I hope that whatever offense you have taken with me isn't lasting. Your help to newbies of this forum is noticed and appreciated.

kburger

I hate to jump into the middle of a catfight, but I thought I might offer my 2 cents.

As a minor additional frustration, what if I don't give a durn what action the form used?
Is there no axiomatic way to access the form variable regardless of method (without turning on the globals option)?

$choicevalues=$_POST['choices']; 

// could be changed to 
$choicevalues=$_REQUEST['choices'];
// if you don't know what the method will be.

With regard to the checkbox name problem, if you could somehow get them to change the method to GET you could access the query string and parse it yourself using the super global $_SERVER['QUERY_STRING']. Using your example, if all were checked the query string would look something like

...&choices=One&choices=Two&choices=Three&choices=Four&choices=Five...

If you're stuck with POST I'm afraid I don't have a solution for you.

theauthor

Thank you very much. That's actually quite helpful. It's amazing how long you can program in a language without coming accross such things (especially if you started in a different language and hence are mostly coding by transference). I knew I could process a get by hand. I just wish there was a way to process a post similarly. If anyone knows how to access the STDIN from within PHP. I'll be happy to code up a class that will make all of this transparent. Projected syntax:

<?php
$request = new Request;
$param = $request->get('name',undef,'~~~');
$postparam = $request->get('postonly','post');
$arrayparam = $request->getarray('arrayformel');
?>

where param gets a ~~~ separated list from either get or post
postparam gets a comma separated list from post only
arrayparam gets an array of values accessible by standard $arrayparam[0] etc.

RossC0

Thats great - but unfortunately, changing the forms to GET wont help as he can't change them and if he asks he will lose his job. - Only Joking - its just not a possibilty (he made it quite clear).

Request is effectively just a merge of $GET and $POST - which is nice.

Good news though it can be done! I can see two ways - neither are elegant. Good Luck!

Heres some clues:

To Return All the defined variables use:

var_dump(get_defined_vars());

Also you should look up: $HTTP_RAW_POST_DATA

Hint: it wont exist in your case but it could....

Have fun!

theauthor

In PHP 5 you can access POST data properly as a stream via the special filedescriptor php://input (you can also write to stdout via php://output, no word on the availability of stderr). This works without regard to globals.

Example for illustration only: bad code ahead!

<html>
<head>
</head>
<body>
<?php

//require( "protect.php" );
if ( $_POST['action'] != 'Submit' ) {
?>
<form name="test" method="post" enctype="multipart/form-data">
<input type=checkbox name=test value=1>1
<input type=checkbox name=test value=2>2
<input type=checkbox name=test value=3>3
<input type=checkbox name=test value=4>4
<input type=checkbox name=test value=5>5
<input type=checkbox name=test value=6>6
<input type=submit name=action value=Submit>
</form>
<?php
    }
    else
    {
        print("<br>HTTP_RAW_POST_DATA:<br>");
        print($HTTP_RAW_POST_DATA);
        print("<br>GLOBAL[]:<br>");
        print($_GLOBAL['HTTP_RAW_POST_DATA']);
        print("<br>SERVER:<br>");
        print($_SERVER['HTTP_RAW_POST_DATA']);
        print("<br>fopen php://input:<br>");
        $handle = fopen("php://input", "rb");
        $contents = fread($handle, filesize($filename));
        print($contents);
        fclose($handle);

}
?>
</body>
</html>

Should let you test what method will work for you.

As mentioned previously by kburger, the $_SERVER array includes the query string for GET requests. Thus it is possible to write a handler of the type that I projected previously. I will post here again when I have it coded. (It may be a while since my real job is using php4 with no plans to upgrade so I'll have to squeeze it in.)

Thanks again to everyone who replied.

BTW Another reason for the inherent BADNESS of [] form field names:

<script type="text/javascript">
//function that does something to a multi-field in a form from another element without php
function selectall(sbox) {
var checkboxes = sbox.form.test;
// do stuff with the checkboxes 
}
//function that does something to a multi-field in a form from another element with php
function selectall(sbox) {
var checkboxes = sbox.form.elements['test[]']; //ugly and unnecessary
// do stuff with the checkboxes 
}
</script>

ozzythaman

i'm so sorry for bringing this to the discussion, but i just had to...

errmm... you could BRUTE FORCE check for all possible letter combinations of the post variables.... 😃

while(1){
if isset($_post[$namestring])
do this and that

$namestring=nextpossiblelettercombination();

}

it WOULD work, but you wouldnt like it..

(assuming that i understood the question that is..)

RossC0

Excellent - well found 🙂

By the way according to the manual php://input is available is since PHP 4.3.0 (I haven't tested) - but you should be able to use it with out upgrading to php5.

BTW There are many ways to skin a cat with Javascript - so it doesn't have to look so ugly!

Also, welcome to the forums! - Remember patience is a virtue and do help out others if you can!

Also - you might want to post your code in the code critque section...

Weedpacket

Originally posted by theauthor
BTW Another reason for the inherent BADNESS of [] form field names:
var checkboxes = sbox.form.elements['test[]']; //ugly and unnecessary
[/B]

But, unfortunately perhaps, it's the DOM-specified method to access any form element.

theauthor

Weedpacket: Even so, brackets inside of brackets is just plain unaesthetic. I can live with form.elements['test'] better than form.elements['test[]']. The [] mean nothing to either html or javascript, so I shouldn't have to use them in my html and javascript (or rather they do mean something to the javascript which forces me to use a more complex syntax just to help out php later on). That's really the point. Its an aesthetic simplicity principle. I should also point out that even FF (and NOT in quirks mode) supports the dot-notation version. I don't know if it's official W3C DOM and I'm not a big fan of the "it works so I'll use it" coding philosophy but.... 🙂

RossCO: What I should have said is that my shop is using a version that doesn't support php://input with no plans to upgrade. 🙂 Also, the bad code warning was because it was just a quick test hack; my application coding is not such a mess. I will post there when I get the class written though. Thanks.

ozzy: lol. You didn't understand the question. A brute force attack of that kind would be of no use because the information is NOT there! PHP has discarded it. I KNOW what the names are. In any case even if I somehow didn't know the names a brute force attack is a great joke (which I assume is how you meant it) but not practical (just in case you were serious).

RossC0

So how are you going to get around the problem?

theauthor

Actually, I should mention that we are running 4.3.x. The problem is that although the php://input stream is available it doesn't contain POST data until v5.

I haven't yet figured out a work-around for pre-5 php with globals off. There aren't any variables available to me with the data. May have to give up and tell them it can't be done under the requirements they have set. Argh!

When I said bad code, I didn't realize how bad! I accidently posted an older version of the code. Here's the update:

<html>
<head>
</head>
<body>
<?php

//require( "protect.php" );
if ( $_POST['action'] != 'Submit' ) {
?>
<form name="test" method="post" enctype="multipart/form-data">
<input type=checkbox name=test value=1>1
<input type=checkbox name=test value=2>2
<input type=checkbox name=test value=3>3
<input type=checkbox name=test value=4>4
<input type=checkbox name=test value=5>5
<input type=checkbox name=test value=6>6
<input type=submit name=action value=Submit>
</form>
<?php
    }
    else
    {
        print("<br>HTTP_RAW_POST_DATA:<br>");
        print($HTTP_RAW_POST_DATA);
        print("<br>GLOBAL[]:<br>");
        print($_GLOBALS['HTTP_RAW_POST_DATA']);
        print("<br>fopen php://input:<br>");
        $handle = fopen("php://input", "rb");
$contents = '';
while (!feof($handle)) {
  $contents .= fread($handle, 8192);
}
        print('|');
        print($contents);
        print('|');
        fclose($handle);
        print("<br>phpinfo (Including variables)<br>");
        phpinfo();

}
?>
</body>
</html>