Session Cookies in a contact form??

jpc0480

I've created a contact form that allows my visitors to send me information through the site. The problem is that if they forget to fill in a field my validation redirects them to an "error" page that tells them to go back and fill out all required fields. When they go back all information is lost. What I wanted to know was how would I go about creating a Session Cookie to store the information in the event they fail to input data in all required fields. So that when they do go back all they have to complete is the missing fields.

rsmith

I just pass all the data to the error page and when it redirects, it's not a back button, it's a forward flowing link that passes all the information as variables in the URL then I just populate the fields with PHP.

__berfuzz

jpc0480 wrote:
I've created a contact form that allows my visitors to send me information through the site. The problem is that if they forget to fill in a field my validation redirects them to an "error" page that tells them to go back and fill out all required fields. When they go back all information is lost. What I wanted to know was how would I go about creating a Session Cookie to store the information in the event they fail to input data in all required fields. So that when they do go back all they have to complete is the missing fields.

I would go for the session, no use for a coockie.

session_start(); //needed to start sessions.
//Get all teh felds from the form and store in the session-array.
$_SESSION['form_feld'] = $_POST['form_feld'];

//Show a editform to user.
echo "<p>Edit feld_form:<input name=\"form_feld\" value=\"$_SESSION['form_feld']\" />";

jpc0480

do i need a tag to stop the session? or is that it? also where would i inject the code? at the beginning or after the post?

__berfuzz

jpc0480 wrote:
do i need a tag to stop the session? or is that it?

Well... First of all you need to organize or sort yuor code.

form.html

<form action="process.php" method="post">
<input name="form_field" value="$_SESSION['form_field']" />

process.php

session_start(); //this makes it posible to start a session
$_SESSION['form_field'] = $_POST['form_field'];
//etc

if (isset($_SESSION['form_field'])){
   echo "<p>Is this the right info?</p>";
}else{
   echo "<p>Fill out the form</p>";
}
echo "<form action=\"process.php\" method=\"post\">";
echo "<p>Edit field_form:<input name=\"form_field\" value=\"$_SESSION['form_field']\" />";
//etc
echo "</form>";

Edit: Terrilbe spelling, as allways. :-)

laserlight

isset should also be used to test $_POST['form_field'].

jpc0480

überfuzz wrote:

Well... First of all you need to organize or sort yuor code.

form.html

<form action="process.php" method="post">
<input name="form_field" value="$_SESSION['form_field']" />

process.php

session_start(); //this makes it posible to start a session
$_SESSION['form_field'] = $_POST['form_field'];
//etc

if (isset($_SESSION['form_field'])){
   echo "<p>Is this the right info?</p>";
}else{
   echo "<p>Fill out the form</p>";
}
echo "<form action=\"process.php\" method=\"post\">";
echo "<p>Edit field_form:<input name=\"form_field\" value=\"$_SESSION['form_field']\" />";
//etc
echo "</form>";

Edit: Terrilbe spelling, as allways. :-)

so would I replace teh $fieldname = $_POST['fieldname'] ; with... Sorry just learning PHP - NEWB! Also will this work with my "error" page or will this do something different?

__berfuzz

laserlight wrote:
isset should also be used to test $_POST['form_field'].

Isn't that a bit over the top right now, in this case?

laserlight

Isn't that a bit over the top right now, in this case?

All incoming variables should checked. Aside from that, given that this is the processing page instead of having everything done on one page, some people do things like saving POSTed form results (instead of the form?), so it would be good to inform them that they are on the wrong page.

jpc0480

Ok... Here is the code... Sorry if it may seem a bit whack. As I mentioned before I am a newb... What should I do to this code to make it save the form results in the event the user fails to input all data. Thanks in advance

<?php
$mailto = 'jcollins@mainstreamwebsolutions.com' ;
$subject = "Event Request" ;
$formurl = "http://www.mainstreamwebsolutions.com/planner.html" ;
$errorurl = "http://www.mainstreamwebsolutions.com/error.html" ;
$thankyouurl = "http://www.mainstreamwebsolutions.com/thank you.html" ;

$uself = 0;

$headersep = (!isset( $uself ) || ($uself == 0)) ? "\r\n" : "\n" ;
$contact = $POST['contact'] ;
$email = $POST['email'] ;
$phone = $POST['phone'] ;
$type = $POST['type'] ;
$location = $POST['location'] ;
$month = $POST['month'] ;
$day = $POST['day'] ;
$year = $POST['year'] ;
$time = $POST['time'] ;
$number = $POST['number'] ;
$attire = $POST['attire'] ;
$setting = $POST['setting'] ;
$comments = $_POST['comments'] ;
$http_referrer = getenv( "HTTP_REFERER" );

if (!isset($_POST['email'])) {
header( "Location: $formurl" );
exit ;
}
if (empty($contact) || empty($email) || empty($phone) || empty($location)) {
header( "Location: $errorurl" );
exit ;
}
if (get_magic_quotes_gpc()) {
$comments = stripslashes( $comments );
}

$messageproper =

"This message was sent from:\n" .
"$http_referrer\n" .
"------------------------------------------------------------\n" .
"Name of Contact: $contact\n" .
"Contact E-mail: $email\n" .
"Phone Number: $phone\n" .
"Event Type: $type\n" .
"Date of Event: $month $day $year\n" .
"Time of Event: $time\n" . 
"Location of Event: $location\n" .
"Number of Guests: $number\n" .
"Event Setting: $setting\n" .
"DJ Attire: $attire\n" .

"------------------------- COMMENTS -------------------------\n\n" .
$comments .
"\n\n------------------------------------------------------------\n" ;

mail($mailto, $subject, $messageproper,
"From: \"$contact\" <$email>" . $headersep . "Reply-To: \"$name\" <$email>" . $headersep . "X-Mailer: contact us.php 2.08" );
header( "Location: $thankyouurl" );
exit ;
?>

__berfuzz

laserlight wrote:
All incoming variables should checked. Aside from that, given that this is the processing page instead of having everything done on one page, some people do things like saving POSTed form results (instead of the form?), so it would be good to inform them that they are on the wrong page.

The thing is, I didn't think it what good to mess about with more than one file. Seems that one is more than enough.

laserlight

The thing is, I didn't think it what good to mess about with more than one file. Seems that one is more than enough.

I agree, but as I noted, all incoming variables should be checked with isset or empty before use.

__berfuzz

jpc0480 wrote:

start_session(); //imperative that its there
$mailto = 'jcollins@mainstreamwebsolutions.com' ;
$subject = "Event Request" ;
$formurl = "http://www.mainstreamwebsolutions.com/planner.html" ;
$errorurl = "http://www.mainstreamwebsolutions.com/error.html" ; //this should be a php-file to handle the $_SESSION['form_field']. Use $_SESSION['form_field'] to fil out the form with saved fields.
$thankyouurl = "http://www.mainstreamwebsolutions.com/thank you.html" ;

$uself = 0;

$headersep = (!isset( $uself ) || ($uself == 0)) ? "\r\n" : "\n" ;
//Set the $_SESSIONs
$_SESSION['contact'] = $_POST['contact'];
//etc for each field you wanna save in the session
$contact = $_POST['contact'] ;
$email = $_POST['email'] ;
$phone = $_POST['phone'] ;
$type = $_POST['type'] ;
$location = $_POST['location'] ;
$month = $_POST['month'] ;
$day = $_POST['day'] ;
$year = $_POST['year'] ;
$time = $_POST['time'] ;
$number = $_POST['number'] ;
$attire = $_POST['attire'] ;
$setting = $_POST['setting'] ;
$comments = $_POST['comments'] ;
$http_referrer = getenv( "HTTP_REFERER" );

if (!isset($_POST['email'])) {
	header( "Location: $formurl" );
	exit ;
}
//you could change to $_SESSION['contact'] etc in the if (statement) then you don't need to set a variable for each $_POST['']
if (empty($contact) || empty($email) || empty($phone) || empty($location)) {
   header( "Location: $errorurl" );
   exit ;
}
if (get_magic_quotes_gpc()) {
	$comments = stripslashes( $comments );
}

$messageproper =

"This message was sent from:\n" .
"$http_referrer\n" .
"------------------------------------------------------------\n" .
"Name of Contact: $contact\n" .
"Contact E-mail: $email\n" .
"Phone Number: $phone\n" .
"Event Type: $type\n" .
"Date of Event: $month $day $year\n" .
"Time of Event: $time\n" . 
"Location of Event: $location\n" .
"Number of Guests: $number\n" .
"Event Setting: $setting\n" .
"DJ Attire: $attire\n" .

"------------------------- COMMENTS -------------------------\n\n" .
$comments .
"\n\n------------------------------------------------------------\n" ;

mail($mailto, $subject, $messageproper,
	"From: \"$contact\" <$email>" . $headersep . "Reply-To: \"$name\" <$email>" . $headersep . "X-Mailer: contact us.php 2.08" );
header( "Location: $thankyouurl" );
exit ;

I commented the script, I didn't test it, but it should give you some pointers.

laserlight

Actually, if you use überfuzz's suggestion to keep to one file, you do not need to use session variables here.

Instead, you would set the value of the form elements if the corresponding incoming variables (e.g., $_POST['contact']) are set.

jpc0480

überfuzz wrote:
I commented the script, I didn't test it, but it should give you some pointers.

<?php
session_start();	
$mailto = 'jcollins@mainstreamwebsolutions.com' ;

$subject = "Event Request" ;
$formurl = "http://www.mainstreamwebsolutions.com/planner.html" ;
$errorurl = "http://www.mainstreamwebsolutions.com/error.html" ;
$thankyouurl = "http://www.mainstreamwebsolutions.com/thank you.html" ;

$uself = 0;

$headersep = (!isset( $uself ) || ($uself == 0)) ? "\r\n" : "\n" ;

$_SESSION['contact'] = $_POST['contact'];
$_SESSION['email'] = $_POST['email'];
$_SESSION['phone'] = $_POST['phone'];
$_SESSION['location'] = $_POST['location'];

$contact = $_POST['contact'] ;
$email = $_POST['email'] ;
$phone = $_POST['phone'] ;
$type = $_POST['type'] ;
$location = $_POST['location'] ;
$month = $_POST['month'] ;
$day = $_POST['day'] ;
$year = $_POST['year'] ;
$time = $_POST['time'] ;
$number = $_POST['number'] ;
$attire = $_POST['attire'] ;
$setting = $_POST['setting'] ;
$comments = $_POST['comments'] ;
$http_referrer = getenv( "HTTP_REFERER" );

if (!isset($_POST['email'])) {
	header( "Location: $formurl" );
	exit ;
}
if (empty($contact) || empty($email) || empty($phone) || empty($location)) {
   header( "Location: $errorurl" );
   exit ;
}
if (get_magic_quotes_gpc()) {
	$comments = stripslashes( $comments );
}

$messageproper =

"This message was sent from:\n" .
"$http_referrer\n" .
"------------------------------------------------------------\n" .
"Name of Contact: $contact\n" .
"Contact E-mail: $email\n" .
"Phone Number: $phone\n" .
"Event Type: $type\n" .
"Date of Event: $month $day $year\n" .
"Time of Event: $time\n" . 
"Location of Event: $location\n" .
"Number of Guests: $number\n" .
"Event Setting: $setting\n" .
"DJ Attire: $attire\n" .

"------------------------- COMMENTS -------------------------\n\n" .
$comments .
"\n\n------------------------------------------------------------\n" ;

mail($mailto, $subject, $messageproper,
	"From: \"$contact\" <$email>" . $headersep . "Reply-To: \"$name\" <$email>" . $headersep . "X-Mailer: contact us.php 2.08" );
header( "Location: $thankyouurl" );
exit ;
?>

Ok this is the revised script... For some reason it still is not saving the fields... Am I missing something?

jpc0480

OK I read your script over and you're suggesting that I create a PHP page instead of a html? What would I have to do? Could I still keep the same contents on the php page or would I have to do something completely different?

laserlight

OK I read your script over and you're suggesting that I create a PHP page instead of a html? What would I have to do? Could I still keep the same contents on the php page or would I have to do something completely different?

Yes. This script would check if the form is submitted. If so, it processes the form. If not, it displays the form. If the user input submitted needs correction, you halt the form processing, and then display the form with the appropriate error message. Since each input control of the form displays its own value (if it exists as checked by isset or empty in PHP), the user's current input will be displayed.

Of course, this page does not actually have to process the form. If the the user input is valid, you could save it to a session, then re-direct the user to the real form processing page. This helps to avoid high speed multiple post spamming.

jpc0480

could i take an existing html page that i am using for my error page and add the php code? if so what code do i have to have? sorry for being a newb.

laserlight

could i take an existing html page that i am using for my error page and add the php code?

Yes, though you would may need to change the file extension to .php.

if so what code do i have to have?

As an example to give you a general idea:

<?php
// To make printing of form values easier.
function printPostValue($name) {
    if (isset($_POST[$name])) {
        echo ' value="' . htmlspecialchars($_POST[$name]) . '"';
    }
}

$show_form = true; // Show the form by default.
// Check if form was submitted.
if (isset($_POST['submit'])) {
    if (isset($_POST['message']) && strlen($_POST['message']) > 5) {
        echo '<h1>Your message is: ' . htmlspecialchars($_POST['message']) . '</h1>';
    } else {
        // Print error message.
        echo '<h1>Your message must be longer than 5 characters.</h1>';
    }
}

if ($show_form) {
?>
<form action="<?php echo $_SERVER['PHP_SELF']; ?>" method="post">
<input type="text" name="message"<?php printPostValue('message'); ?> />
<input type="submit" name="submit" value="Post" />
</form>
<?php } ?>

Note that this only has one relevant form input control, so the error checking can be rather simple.

jpc0480

laserlight wrote:

Yes, though you would may need to change the file extension to .php.

As an example to give you a general idea:

<?php
// To make printing of form values easier.
function printPostValue($name) {
    if (isset($_POST[$name])) {
        echo ' value="' . htmlspecialchars($_POST[$name]) . '"';
    }
}

$show_form = true; // Show the form by default.
// Check if form was submitted.
if (isset($_POST['submit'])) {
    if (isset($_POST['message']) && strlen($_POST['message']) > 5) {
        echo '<h1>Your message is: ' . htmlspecialchars($_POST['message']) . '</h1>';
    } else {
        // Print error message.
        echo '<h1>Your message must be longer than 5 characters.</h1>';
    }
}

if ($show_form) {
?>
<form action="<?php echo $_SERVER['PHP_SELF']; ?>" method="post">
<input type="text" name="message"<?php printPostValue('message'); ?> />
<input type="submit" name="submit" value="Post" />
</form>
<?php } ?>

Note that this only has one relevant form input control, so the error checking can be rather simple.

Thanks for your help... So if I understand you correctly I could use my existing page, however I would have to change it to a php extension? What values would I change to reflect my form? Thanks again... Sorry for being a newb.