Variable to $_POST from input button

liquidgenius

Now that it is in vogue to have RegisterGlobals turned off by default, how do you do something like this:

<input name="edit" type="button" value="Edit" onClick="location.href='/addeditsite/index.php?site=1';"

Since you cannot pass variables in the URL, it wont work.

This is what I came up with using javascript to write the selection to the form variables before submission. Then I could process the $_POST values in the header and redirect. I think I am still missing something:

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN" "http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1" />
<title>Test</title>

<script language="JavaScript" type="text/javascript">
function setChoice (a,b) {
		document.testForm.entryChoice.value = a;
		document.testForm.entryOption.value = b;
		document.testForm.submit();
		//return false; This would set the value but not submit the form.
}
</script>
</head>

<body>
<?php 
if(isset($_POST['entryChoice']) && isset($_POST['entryOption'])){
echo($_POST['entryChoice'] . "<br/>" . $_POST['entryOption']); 
}
?>
<form action="" method="POST" id="testForm">
<table width="100%" border="1" cellspacing="0" cellpadding="3">
	<tr>
		<td>1</td>
		<td nowrap="nowrap">This is a test entry</td>
		<td width="100%"><input name="view" type="button" onClick="setChoice(1,1);" value="View">
		<input name="edit" type="button" onClick="setChoice(1,2);" value="Edit"></td>
	</tr>
	<tr>
		<td>2</td>
		<td nowrap="nowrap">Yet another test entry</td>
		<td width="100%"><input name="view" type="button" onClick="setChoice(2,1);" value="View">
		<input name="edit" type="button" onClick="setChoice(2,2);" value="Edit"></td>
	</tr>
</table>
</form>
</body>
</html>

bradgrafelman

liquidgenious wrote:
Since you cannot pass variables in the URL, it wont work.

Says who?

Kold

<input name="edit" type="button" value="Edit" onClick="location.href='/addeditsite/index.php?site=1';"

<?php 
echo $_GET['site']; // 1
?>

🙂

Houdini

As seen in the above POST you can still pass variables in the URL if you really want to, you just use a different techique. Personally I dislike passing variables in this manner mostly cause I don't like seeing them in the URL anyway.

liquidgenius

So correct me if I am wrong... but having RegisterGlobals turned off does not prevent you from passing variables in the URL? I thought this is why it was turned off... because passing variables in the URL was a security risk.

Lets say I still wanted a method to pass the variables in the $_POST superglobal.... was my idea for it far off?

Thanks!

bradgrafelman

The reason RegisterGlobals was turned off, was because when you passed something in the URL, it was immediately extracted into a variable, such as $site. Turning off RegisterGlobals has nothing to do with the superglobal arrays, so $_GET['site'] works just fine regardless of the directive's setting.

Looking at your JS, you might need to use a NAME tag on the form, or use JS' getElementById() - I'm not sure.

halojoy

liquidgenius wrote:
So correct me if I am wrong... but having RegisterGlobals turned off does not prevent you from passing variables in the URL? I thought this is why it was turned off... because passing variables in the URL was a security risk.

Lets say I still wanted a method to pass the variables in the $_POST superglobal.... was my idea for it far off?

I most often use POST, because I also dont like seeing them in URL.
Passing variables in URL can be making it easier for hackers.

For big public sites I would prefer POST.
Looking at softwares like phpBB, vBulletin and most every forum, they use GET.
Because it is a practical way to pass variable values.
For example this page I am writing now:

http://phpbuilder.com/board/newreply.php?do=newreply&p=10737874

We can say, that harmless infomation and variables can be passed as GET,
but we should always use POST for data that is private or secure.

Kold

halojoy wrote:
We can say, that harmless infomation and variables can be passed as GET,
but we should always use POST for data that is private or secure.

Just to clarify - post is not really that much more secure, it just 'covers up' and stops people leaning over your shoulder to see your password in the title bar 😉 If you want proper security, you will need to send using post over a secure connection.

liquidgenius

Thanks all, you've been a big help! The following works also (Took your advice on the getElementById and had to add hidden fields for the javascript values to populate)

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN" "http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1" />
<title>Test</title>

<script language="JavaScript" type="text/javascript">
function submitChoice (formId,a,b) {
        frm = document.getElementById(formId);
		frm.entryChoice.value = a;
		frm.entryOption.value = b;
		frm.submit();
}
</script>
</head>

<body>
<?php
if(isset($_POST['entryChoice']) && isset($_POST['entryOption'])){
echo($_POST['entryChoice'] . "<br/>" . $_POST['entryOption']);
}
?>
<form action="../test.php" method="POST" id="testForm">
<input type="hidden" name="entryChoice">
<input type="hidden" name="entryOption">
<table width="100%" border="1" cellspacing="0" cellpadding="3">
	<tr>
		<td>1</td>
		<td nowrap="nowrap">This is a test entry</td>
		<td width="100%"><input name="view" type="button" onClick="setChoice(this.form.id,1,1);" value="View">
		<input name="edit" type="button" onClick="setChoice(this.form.id,1,2);" value="Edit"></td>
	</tr>
	<tr>
		<td>2</td>
		<td nowrap="nowrap">Yet another test entry</td>
		<td width="100%"><input name="view" type="button" onClick="setChoice(this.form.id,1,1);" value="View">
		<input name="edit" type="button" onClick="setChoice(this.form.id,2,2);" value="Edit"></td>
	</tr>
</table>
</form>
</body>
</html>