Sessions &amp; Forms

Sessions & Forms

Anon

1)I have a form in my page. I register my form variables using session_register('var').

session_register('var1');
session_register('var2');

//form follows here

If I submit the form and use back to navigate back, I get the foll:

Warning: Page has Expired The page you requested was created using information you submitted in a form. This page is no longer available. As a security precaution, Internet Explorer does not automatically resubmit your information for you.

To resubmit your information and view this Web page, click the Refresh button.

This did not happen when i used hidden variables to pass data from one form to another.

2) How do I update my variables. Suppose if I want to change the value of a variable stored in a session, Can I go back to corresponding form & update. How does it work? I tried this but it seems to take the original values only. Is there a way to rewrite the value of variables already stored in session?

3) How can php variables be accessed from Javascript?

Anon

We recently encountered the same problem and found two solutions. The first was to use GET rather than POST (I think the limit is 4096 bytes with GET though) and this eliminated the data missing problem when using the back button.

The other option (which I admit we haven't tried) was to submit the data to the same PHP page and use a header("Location: nextpage.phtml") to redirect to the next page once the form data was verified.

I don't know the specifics of what you are trying to do, but those options might step you in the right direction.

Tim Frank

Anon

How do u use the header to redirect the page. The GET Method seems to work fine but it limits the amount of data I can send.
Regards,
sbs

Anon

How do u use the header to redirect the page

I do this all the time, and it works great. Basic outline:

&;lt;?php
include('header.php');
function display_my_form(...)
{
global $PHP_SELF, $form_field1, ...;

header('Title');
// display form stuff here
footer(); // adds copyright notice, </body>, </html> etc.
exit;
}

if ($REQUEST_METHOD == 'POST')
   {
   if ($form_field1 == '') // only do this for required fields
      $missing = 1;
   if ($form_field2 == '')
      $missing = 1;
   
   if ($missing)
      display_my_form();
   else
      {
      // update database here, etc.
      header("Location: my_followup.php");
      }
   }
else // first time, just load form
   display_my_form();
?>

Anon

What is the advantage of the way u do versus:

print('<form action="Redirect.php" method="POST"');

print('OnSubmit="return ValidateForm(this)" name="MyForm">');

I do not understand why we need to use header(' '); to redirect? Is there an advantage?

Where is the field validation done in your code? I guess it is on the server side. Is it not better to use javascript to do client side validation.

Thanks
sbs

Anon

You use header to redirect so the browser does not give the "data missing" error that you wanted to avoid. By submitting to the same page and assigning the session variables, checking the request method etc, you can control when and how the page is forwarded. If you don't do it that way then you get the error you don't want (and I thought you asked for a solution to that problem??)

It is not always better to use javascript and do client side validation. For one anybody can view the source of your validation and find ways to defeat it if it isn't vigorous. (Sure they could defeat it if it was written in PHP, but they would really have to guess at it). I tend to use it only for fancy client side trickery to build more user friendly "GUI's" on web pages, so I am biased 🙂 Plus if you don't want to use ANY javascript you don't have to bother with two languages on all your pages. Secondly if you ever do any validation against a database or file or whatever then javascript may not suit your needs.

These two methods DO solve the problem you have encountered. Sure it is a work-around if you really need to send > 4096 bytes on your forms, but it works.

Use what works best for your specific project. Not all fixes suit specific needs, but they are usually possible.

Hope that helps.

Anon

I found the foll: solution in php.net & guess what, all my problems disappeared. I am able to modify the forms as well as go back on navigation.

GET and POST values overriding session variables.
For those situations where I specifically want GET and POST variables to override values in session variables, I wrote the following function....
function grabvar($varname)
{
global $$varname, $HTTP_GET_VARS, $HTTP_POST_VARS;

session_register($varname);
if (isset($HTTP_POST_VARS[$varname]))
{
$$varname = $HTTP_POST_VARS[$varname];
}
if (isset($HTTP_GET_VARS[$varname]))
{
$$varname = $HTTP_GET_VARS[$varname];
}
}

?>
I put it into a file which I always include in the head of all my php scripts. Then in the scripts, instead of session_register(), I call my function, like this...
&lt;?php
require("utils.inc&quot😉;
grabvar("my_var&quot😉;
grabvar("my_other_var&quot😉;
?>

Thus I have a reasonably neat and tidy way of reading GET and POST values into sessions and still maintaining control over exactly which variables get saved.