Using FPDF in an application - php

Question

I have been testing with FPDF and it's going okay in terms of making the PDF.
In my application I plan to have a button that reads 'Convert to PDF' and when the user clicks it, FPDF will create the PDF in a new window using given variables.
The code to generate the PDF is like the below:
require_once("fpdf.php");
$author = "Test";
$title = "Candidate profile";
$width = 10;
$height = 10;
$text = "Test";
$font_family = 'Arial';
$font_size = 11;
$file_name = "candidate-profile-jesse-orange";
$extension = ".pdf";
$output = "I";
$heading_size = 16;
$subheading_size = 13;
class PDF extends FPDF
{
// Page header
function Header()
{
// Logo
$this->Image('logo.png',10,10,30);
// Arial bold 15
$this->SetFont('Arial','B',16);
// Move to the right
$this->Cell(50);
// Title
$this->Cell(100,8,'Candidate profile for: Jesse Orange',1,0,'C');
// Line break
$this->Ln(20);
}
// Page footer
function Footer()
{
// Position at 1.5 cm from bottom
$this->SetY(-15);
// Arial italic 8
$this->SetFont('Arial','I',8);
// Page number
$this->Cell(0,10,'Page '.$this->PageNo(),0,0,'R');
}
}
// Create a new instance
$pdf = new PDF("P", "mm", "A4");
// Set some default options
$pdf->setAuthor($author);
$pdf->setTitle($title);
$pdf->AddPage();
$pdf->SetDisplayMode("real",'default');
$pdf->SetFont($font_family, '', $font_size);
// Field
$pdf->SetFont($font_family, 'B', $font_size);
$pdf->Cell(40, $height, "Position applied for:", 0, 0);
// Value
$pdf->SetFont($font_family, '', $font_size);
$pdf->Cell(60, $height, "Innovation Advisor (Job ID: 221)", 0, 0);
// Field
$pdf->SetFont($font_family, 'B', $font_size);
$pdf->Cell(40, $height, "Date of application:", 0, 0);
// Value
$pdf->SetFont($font_family, '', $font_size);
$pdf->Cell(50, $height, "17th July 2017", 0, 1);
$pdf->Output($file_name.$extension, $output);
On a separate page you have the output from a database query and variables for each field eg:
$name = "John";
$surname = "Smith";
Or more correctly...
$name = $row['name'];
My question is: should I post the already stored variables to a seperate script to generate the PDF or should it be on the same page?
Theoretically on button press you could call $pdf->Output();
Addition:
The variables displayed on the page are for viewing in the browser, then when a user would click convert to PDF it would simply grab these variables and use them with FPDF.
A similar example is how Google Analytics allows you to download a report as a PDF.

Answer 1

Given this flow:
Database values are displayed to end user
User reviews values and optionally generates the PDF files
... where the user is not allowed to edit the values (i.e. they aren't defaults but final ones), submitting them to the server does not make sense. The server already has direct access to such values, if you make them come from external sources they become untrusted input and you're forced to validate them.
Just make sure you have a reusable design so you don't need to implement the read values code twice.
In fact it's an anti-pattern I've actually seen in the wild now and then. In the worst case, it was a "Modify my profile" page that took user ID from the URL (rather than grabbing the ID of the currently validated user from session). Go figure the risk ;-)