What wrong with this form? Why I cannot submit the xml file

[mikerh9]

<?php
$xml='
<?xml version="1.0" encoding="iso-8859-1"?>
<Request><Send><Key>123123123</Key><Number>10</Number></Send><BInfo><LName>Pizza</LName><LAddress>somewhere</LAddress><LCity>city</LCity><LState>NY</LState><LZip>112</LZip><LPhone>131313132</LPhone></BInfo></Request>
';

<form method='post' action='script.php'>
<input type='text' name='xml' value='<?=$xml?>'>
<input type='submit' name='submit' value='submit'>
<form>

What's wrong with this code? Why I cannot submit xml through Post.

[harmor]

if the form is still within php then you don't need to use <?=$xml?>

<?php
$xml='
<?xml version="1.0" encoding="iso-8859-1"?>
<Request><Send><Key>123123123</Key><Number>10</Number></Send><BInfo><LName>Pizza</LName><LAddress>somewhere</LAddress><LCity>city</LCity><LState>NY</LState><LZip>112</LZip><LPhone>131313132</LPhone></BInfo></Request>
';

echo "<form method='post' action='script.php'>
<input type='text' name='xml' value='$xml'>
<input type='submit' name='submit' value='submit'>
<form>";
?>

If the form is outside of php then maybe your server doesn't allow short-hand php.

<?php
$xml='
<?xml version="1.0" encoding="iso-8859-1"?>
<Request><Send><Key>123123123</Key><Number>10</Number></Send><BInfo><LName>Pizza</LName><LAddress>somewhere</LAddress><LCity>city</LCity><LState>NY</LState><LZip>112</LZip><LPhone>131313132</LPhone></BInfo></Request>
';
?>

<form method='post' action='script.php'>
<input type='text' name='xml' value='<?php echo $xml; ?> '>
<input type='submit' name='submit' value='submit'>
<form>

[mikerh9]

I tried both ways, still got the error message. Cannot submit the xml file. And I have no idea what can cause the problem...

[harmor]

what does the error message say and can you post the code in "script.php"?

[mikerh9]

Description: Request Validation has detected a potentially dangerous client input value, and processing of the request has been aborted. This value may indicate an attempt to compromise the security of your application, such as a cross-site scripting attack. You can disable request validation by setting validateRequest=false in the Page directive or in the configuration section. However, it is strongly recommended that your application explicitly check all inputs in this case.

This is the error message.

[Weedpacket]

Try using [man]htmlspecialchars[/man] to fix the " and < and > before you put them in the form.

[_theworks]

does this help?

<?php
if (!isset($_POST['xml']) {
$xml='
<?xml version="1.0" encoding="iso-8859-1"?>
<Request><Send><Key>123123123</Key><Number>10</Number></Send><BInfo><LName>Pizza</LName><LAddress>somewhere</LAddress><LCity>city</LCity><LState>NY</LState><LZip>112</LZip><LPhone>131313132</LPhone></BInfo></Request>
';
?>
<form method="POST">
<input type='text' name='xml' value='<?=$xml?>'>
<input type='submit' name='submit' value='submit'>
<form>
<? } else {

$xml = htmlspecialchars($_POST['xml']);

echo $xml

}