Is it safe to call php service from onClick? - php

Question

What I want know that is that when form data is POST to a php service directly from onClick="insert.php" then is it safe. Please explain your answer with details.
for example:
<form role="form" method="POST" enctype="multipart/form-data">
<div class="form-group">
<label>User Id</label>
<input class="form-control" name="First Name">
</div>
<div class="form-group">
<label>City Id</label>
<input class="form-control" name="Last Name">
</div>
<button type="submit" class="btn btn-primary" onclick="allowStory.php">Allow</button><button type="submit" class="btn btn-primary" onclick="insert.php">Insert</button>
</form>
It also return to same page by executing php service as I wanted. But question is that is it safe? and is this type have any drawback? if yes then what are those?

Answer 1

Putting a filename in onclick doesn't do anything, the onclick attribute has to contain Javascript code.
If you want a submit button to go to a specific script instead of the action of the form, use the formaction attribute.
<button type="submit" class="btn btn-primary" formaction="allowStory.php">Allow</button><button type="submit" class="btn btn-primary" formaction="insert.php">Insert</button>
It's perfectly safe to do this, it's no different from specifying the action of the form in the action="scriptname.php" attribute of the <form> tag.

Answer 2

Use following HTML
<form role="form" method="POST" id="formsend" enctype="multipart/form-data">
<div class="form-group">
<label>User Id</label>
<input class="form-control" name="First Name">
</div>
<div class="form-group">
<label>City Id</label>
<input class="form-control" name="Last Name">
</div>
<input type="submit" name="submit" value="Submit" /></form>
<script src="http://code.jquery.com/jquery-1.11.0.min.js"></script>
<script>
$(document).on('submit', '#formsend', function()
{
$.post('savedate.php', $(this).serialize(), function(data)
{
$("#sent").html(data);
});
return false;
});
and create a savedata.php or any other name and put your php code to save data in it. you can not give filename to onclick event