loaded page from javascript. tested for GET & POST. Only GET set as expected;
window.location.href = "medications_edit_revised.html?recordId="+id ;
Retrieved and used the data from the GET[]
Reloaded page from SUBMIT as shown below.
<form method="post" action="">
<table id="detailsDivTable">
<?php
$editClass->selectTheRecord();
?>
</table>
<fieldset name="Group1">
<legend>Group box</legend>
<input name="saveButton" type="submit" value="Save" />
<input name="deleteButton" type="submit" value="Delete" />
<input name="cancelButton" type="submit" value="Cancel" />
</fieldset>
</form>`
Tested GET[] & SET[]
if (isset($_GET['recordId']) ) {
$recordId = $_GET['recordId'];
require_once "medications_edit_revised.class.php";
$editClass = new editRevisedClass($DBH, $recordId);
}
if(isset($_POST['saveButton'])) {
Both tested TRUE. Is this normal behavior. I expected the GET[] would have been cleared when the form was POSTed
If yes is there a way to clear the GET before sending the SUBMIT
Thanks
When you set the URL like this:
window.location.href = "medications_edit_revised.html?recordId="+id ;
You have set URL params. Then when you do this:
Reloaded page from SUBMIT as shown below.
<form method="post" action="">
Because the action is empty it'll retain the URL parameters, because that's what empty and (eg) $_SERVER['PHP_SELF'] do - they send to the current URL, params and all.
You already know the URL so just set it as needed:
action="medications_edit_revised.html"
You seem to be confusing POST/GET requests and the PHP $_POST and $_GET superglobal variables.
PHP will populate $_GET with data in the query string of the URL the request was made to.
PHP will populate $_POST with data in the request body of a POST request if that data is encoded using a supported encoding.
It doesn't matter if the request was caused by JavaScript, a form submission, or something else.
Is this normal behavior.
Yes
If yes is there a way to clear the GET before sending the SUBMIT
Submit the form to a URL which does not have a query string.
The URL the form is submitted to will be specified by the action attribute.
If you don't have an action attribute, it will be submitted to the URL of the current page. If that URL has a query string, then so will be the URL that the form is submitted to (and thus $_GET will be populated).
If you want to avoid that, then specify the action explicitly.
Can you please past some of your code?
If you use GET to revice your variable, it gets it from the URL: example.com?name=jesper&lastname=kaae
The differences is:
GET requests a representation of the specified resource. Note that GET should not be used for operations that cause side-effects, such as using it for taking actions in web applications. One reason for this is that GET may be used arbitrarily by robots or crawlers, which should not need to consider the side effects that a request should cause.
And
POST submits data to be processed (e.g., from an HTML form) to the identified resource. The data is included in the body of the request. This may result in the creation of a new resource or the updates of existing resources or both.
You can read more about them here
Related
<form action="<?php echo htmlspecialchars($_SERVER["PHP_SELF"]);?>" onsubmit="return checkValid(this)" method="GET">
<input type="text" name="Symbol">
<input type="submit" name="submit" value="Search">
</form>
<?php
if($_SERVER["REQUEST_METHOD"] == "GET"){
echo "test";
$CSymbol = $_GET["Symbol"];}
?>
when the page was first load and did not press submit button, the php was executed and "test" was print on the screen, also with error:
Notice: Undefined index: Symbol in test.php on line 179
but if i change everything to POST, problem solved. Why is that, what's different btn GET and POST?
GET values are sent in the URL, POST in the HTTP Body. So "GETting" values can alsways be done but may be empty. POST has to be manually created. If you want to use GET in this case however. Guard it:
<?php
if($_SERVER["REQUEST_METHOD"] == "GET" && isset($_GET["Symbol"]){
echo "test";
$CSymbol = $_GET["Symbol"];}
?>
Reference Link
GET and POST are two different types of HTTP requests.
According to WikiPedia:
GET requests a representation of the specified resource. Note that GET should
not be used for operations that cause side-effects, such as using it for taking
actions in web applications. One reason for this is that GET may be used
arbitrarily by robots or crawlers, which should not need to consider the side
effects that a request should cause.
and
POST submits data to be processed (e.g., from an HTML form) to the identified
resource. The data is included in the body of the request. This may result in
the creation of a new resource or the updates of existing resources or both.
So essentially GET is used to retrieve remote data, and POST is used to insert/update remote data.
Authors of services which use the HTTP protocol SHOULD NOT use GET based forms
for the submission of sensitive data, because this will cause this data to be
encoded in the Request-URI. Many existing servers, proxies, and user agents will
log the request URI in some place where it might be visible to third parties.
Servers can use POST-based form submission instead
Finally, an important consideration when using GET for AJAX requests is that some browsers - IE in particular - will cache the results of a GET request. So if you, for example, poll using the same GET request you will always get back the same results, even if the data you are querying is being updated server-side. One way to alleviate this problem is to make the URL unique for each request by appending a timestamp.
For your above code..
<form action="<?php echo htmlspecialchars($_SERVER["PHP_SELF"]);?>" onsubmit="return checkValid(this)" method="GET">
<input type="text" name="Symbol">
<input type="submit" name="submit" value="Search">
</form>
<?php
if($_SERVER["REQUEST_METHOD"] == "GET" && !empty($_GET['Symbol'])){
echo "test";
$CSymbol = $_GET["Symbol"];}
?>
Every http request that is not a POST counts as a GET request, and so every page that loads up has an empty GET request, php will create a super global $_GET array with every non post request.
Hope this helps you understand what is going on.
I have html page and I have taken one form in it and other link outside the form .Form is Submitted by POST method,when I submitting form first time its ok and when I click link it pass data by GET method and when I again submit form then it send both GET and POST variable i.e form data and link data both.so what is the reason for that and how can I solve it.My html page is below
<html>
<body>
<form method='post'>
<input type=input name='name'/>
<input type=submit name='submit' value='submit'/>
</form>
<a href='check_global.php?page_number=6'>Page Number</a>
</body>
</html>
Because the form hasn't the action attribute, so it simply reload the page. When you submit it the first time it's all fine, but when you do it after clicking the link, the url is 'dirty' due to the data of the link, so you have both GET and POST values.
You can check wether the POST attribute is set ( if(isset($_POST['name'])) with php), in this case it has been submitted with the form
When you submit the form the second time you see the form parameters + the url parameter of the page (remember you clicked the link with the relative URL 'check_global.php?page_number=6').
To verify the above try this:
<?php
echo 'GET param ' . $_GET["page_number"];
echo 'POST param ' . $_POST["name"];
?>
As you can see you can access both types of parameters during a POST request.
Hope that helps.
Just to make the point, the OP did not indicate that the form was supposed to submit to anywhere but the current page. So just for funsies, here is the same basic idea, but with an action attribute value:
<form method="post" action="">
<input type="text" name="name"/>
<input type="submit" name="submit" value="submit"/>
</form>
Page Number
Notice that I've set it up so that, for whatever reason, the link points back to this same page and so does the form. The result:
First Load: form submit makes request with POST data to blah.php
Second Load: link follow makes request with GET (thanks to the query string) to blah.php?page_number=6
Third Load: form submit, using blank action to indicate that current page is where to post, makes request with POST form data to blah.php?page_number=6, thus having both POST form data and GET URL data.
So your options are to either set the action attribute value to blah.php so that it does not include the query string, or to accept that if you want to avoid the various ways of doing this in favor of having a more modular form (drop it in any page and you know it will post to that address), then to simply have the PHP backend check if $_POST['submit'] is set and if so, handle it like a form post and don't use any of the $_GET logic that might be screwing things up.
The link is never sending the form data as POST, and the POST data is not part of the GET array, so you know that when there is no POST, it's just get and if there is POST, it was a form submit, even if there is a GET array.
Or just use separate scripts so you don't get mixed up.
I have a https page named user.php that gets data and posts it to another receiving.php https page. My problems is whenever I submit my data for posting the receiving.php displays server error. I have read articles about cURL but I don't have a clear picture of the syntax.
user.php
<form action="https://www.mydomain.com/ssl/receiving.php">
<input type="text" name="variable" />
<input type="submit" name="buttonName" />
</form>
receving.php
if(isset($_POST["buttonName"]))
{
$variable=$_POST['variable'];
}
You want to add method="POST" to your form tag. By default it'll submit through GET. If that doesn't work, try var_dump($_POST) in receiving.php to see exactly what's coming through. cURL is mainly for when you want a script to make a request to a server on its own. A form submit shouldn't need to worry about cURL.
What error are you receiving though? This shouldn't display an error as your isset() should just return false.
you need to use the $_GET method instead of $_POST because $_GET is a method that displays your request in the form in URL. while $_POST for security reason is just getting data from the form and not displaying the actions you've requested.
<form action="https://www.mydomain.com/ssl/receiving.php">
if you want to use $_POST you need to make your form method set to method="POST" or by default your method form is using "GET".
So you instead of using $_POST , you need to use $_GET in your case.
I understand that I am able to use the POST method for URL parameters to display data according to a specific variable, I know how to make use of the GET method - but I am told that the POST method can be used to hide the part of the URL that is like this.
/data.php?parameter=1234
What is the actual difference of the two methods in terms of URL parameters?
Below is some code that fetches data from a database according to the id of a specific link
<?php
//This includes the variables, adjusted within the 'config.php file' and the functions from the 'functions.php' - the config variables are adjusted prior to anything else.
require('configs/config.php');
require('configs/functions.php');
//This is the actual interaction with the database, according to the id.
$query = mysql_query("SELECT * FROM table WHERE id=" .$_GET['id'] . ";") or die("An error has occurred");
//This re-directs to an error page the user preventing them from viewing the page if there are no rows with data equal to the query.
if( mysql_num_rows($query) < 1 )
{
header('Location: 404.php');
exit;
}
//Here each cell in the database is fetched and assigned a variable.
while($row = mysql_fetch_array($query))
{
$id = $row['id'];
$title = $row['title'];
$month = $row['month'];
$day = $row['day'];
$photo = $row['photo'];
$text = $row['text'];
}
?>
On a separate page I generate links to the data.php file according to the ID like so:
<?php echo $content['title']; ?>
Forgetting that there are potential SQL injections that can occur through the above code, how would I go about making use of the POST method in order to hide the URL parameters, or at least not display them like this:
http://example.com/data.php?id=1
In order to use POST, you will need to use a <form> tag, and depending on how you are pulling up these URLs, it could be easier to use javascript to help out. Here's a basic example:
<form method="post" action="data.php">
<input type="hidden" name="parameter" value="1234" />
<input type="submit" value="Go" />
</form>
The Go button would POST the form data, and now in data.php you will be able to retrieve the value from $_POST['parameter']. Note that when using POST, you will probably want to redirect (HTTP 302) back to a page so that when a user hits the back button, the browser doesn't prompt to resubmit the form.
Using javascript, you could set the parameter input to a different value before posting the form.
Use method "POST" for your form. I had the same issue, just adding POST to the form removed the parameters from the URL
<form id="abc" name="abc" action="someaction.php" method="post">
<input type="text" id="username" name="username"/>
<input type="password" id="password" name="password"/>
<input type="submit" id="submit" name="submit" value="submit"/>
</form>
To POST values, a browser would have to use a form with method="post", or javascript simulating a form. Various developer tools (fireug, etc) can convert GET forms to POST forms, but generally, a form is what is required.
In theory GET requests should not have any side effects, and "should" be consistent from request to request. That is, the server should return the same content. In todays world of just about everything being dynamic, this might be of little practical design significance.
Whether you use GET or POST, the parameters will appear in $_REQUEST. The critical difference is that using POST allows the variables NOT to appear in URL history. This decreases the visibility of data such as passwords which you do not want to show up in URL history. To use POST instead of GET, simply produce <form method="POST" ...> in the document.
Even better is to store sensitive values (like user ids) in cookies, so that they don't appear in $_REQUEST at all. Since the contents of cookies are provided in extra HTTP request headers, not in the content, they are generally not stored as part of the history.
In order to use POST instead of GET, you would need to use an HTML form tag in your html, like so:
<form method="POST" action="/data.php">
<input type="hidden" name="parameter" value="1234" />
<button type="submit">Submit</button>
</form>
When submitted, your URL will just be /data.php and parameter=1234 will be in your (hidden) post buffer.
Make sense?
To do a POST, you have to use a form, or some javascript/ajax trickery. An <a> will only ever cause a GET request.
Note that POST requests can still have query parameters in the URL. It's not "normal" to have them, but they are allowed. The main difference being that with a GET request (ignoring cookies), the URL is the ONLY way to send parameters/data to the server. With POST, you can use both the URL, and the body of the POST request, which is where POSTed form data is normally placed.
Ok, so usually I would lookup the form's action attribute (ex: request.php) and would do a cURL post request to that page, but what if the form is being processed by jQuery?
Example
<form method="post" action="profile/post/USERNAME" id="postForm"
onsubmit="funct.post('USERNAME'); return false;" >
...
<input type="button" class="sendButton" id="sendBtn" value="Send"
onclick="funct.post('USERNAME')" />
I have no idea how to work with this form, I've tried submitting to the /profile/post/USERNAME page, but that doesn't work.
Am I missing something?
Actually, I was having problems because the form is using AJAX to post the form.
If looking through MASSIVE, unformatted amount of jQuery code (like in my case) is a problem and doesn't lead anywhere, then a good idea is to look at the headers that are being sent to the server.
I used HTTP Live Headers addon for Firefox to see just that, and noticed that the actual query was token=4324234324¬e=My+Note&ajax=1
Both token and note were present in the form, token as hidden and note as text input, but the ajax=1 is inserted somewhere when it's processed by jQuery.
Headers Don't Lie!