[RESOLVED] Form action help.

Rodney_H_

First of all, I like the new look to the forum. Very cool!

Now, I have a question that is probably simple enough, but I can't find the answer, so maybe one of you more experienced PHP-ers can help.

The question is, when do you use the one page approach (a form and the action on one page with this as the form's action:

<form action="<?php echo $_SERVER['PHP_SELF']; ?>" method="post">

VERSUS, a "two-pager", where you gather user input on one page, and process the input on another page:

1) html form "form.htm"

<form action="process.php" method="post">

2)php page to process the form "process.php"

// retrieve form data
$info = $_POST['info'];

????

I have always gone under the assumption that you always have two pages, but I just read that there may be a 'security' risk by having the php that processes the html page in the same directory as the html page ?? SO, I was thinking of converting all my two pagers into one. Does this make sense and if so or not, why?

-Thanks a million.

drew010

Out of curiousity, where did you read that? (there may be a 'security' risk by having the php that processes the html page in the same directory). Reguardless of where it resides it has to be accessable from the web so users are able to post to it, and having it in the same directory or another, doesn't make much difference or any for that matter.

For me, I like to keep the form and the processor in the same file as long as it remains somewhat short and easy to edit later on, but if it starts getting too long, with the error handling, if/else for the post etc, I will break it down to two pages. As long as you have proper error checking and make sure all the data is valid, there should be no problem having it in one page or two.

Rodney_H_

drew010 wrote:
Out of curiousity, where did you read that? (there may be a 'security' risk by having the php that processes the html page in the same directory).

I am taking a series of beginner's tutorials on Zend.com (here) (which is really a great source of learning for me).

The statement was made by a user in the comments section after a tutorial. Oh, I found the location of the statment here... by Dave von Texas. at the bottom of the page

Anyway, thank you for taking the time to answer my question. I really appreciate it!

Does, it make sense, then, if there are two files to do something like this:

// If no submit, redirect user
if (!isset($_POST['submit'])) {
header(location: form.htm);
exit;

drew010

Okay I see the comment...

1) if the php script is in the same directory as the html file that is a definite security no no.

I wish he would have added why he said that, but dont worry cause it doesnt really matter at all.

I mean, tell me how these two structures make any difference...

/scripts/
  -- form.html
  -- process.php

versus

/scripts/
  -- form.html
  /php-bin/
    -- process.php

both scripts have to be accessable via a browser so having them in the same folder doesnt matter.

Using the !isset post submit is good for seeing if the form was even submitted at all. You can even use $_SERVER['REQUEST_METHOD'] to determine if a user is calling the process script up via their browser and redirect them if the method isn't POST.

As long as you thoroughly validate the incoming data (which should be done in about any form situation) you should be fine doing it in 2 files, a php and html form.

Rodney_H_

That is all exactly what I needed to know. Now I don't have to worry about any security risk.

Thank you so much.

Happy TTGIF.