php server method sends GET instead of DELETE - php

Question

I am trying to implement a basic user registration RESTful api.
I have a html form registerform.html, deregisterform.html, users.php, register.php and deregister.php which are all pasted below.
When i visit the registerform.html in my browser, i can fill in the details and a POST request is received by the users.php script and a json response is echoed back showing the id number of the user thats just been added.
My problem is that when i use the deregister form, the users.php script should recive a DELETE request, but is actually getting a GET request. I've been looking for an answer to this problem but im not finding a solution.
registerform.html
<form action="users.php" method="POST">
Username: <input type="text" name="uname" /><br />
FirstName: <input type="text" name="fname" /><br />
Last Name: <input type="text" name="lname" /><br />
Date of Birth: <input type="date" name="dob" /><br />
Telephone: <input type="mob" name="tel" /><br />
Email: <input type="email" name="email1" /><br />
Confirm Email: <input type="email" name="email2" /><br />
Password: <input type="password" name="pass1" /><br />
Confirm Password: <input type="password" name ="pass2" /><br />
<input type="submit" value="Register" name="sub" />
<br/>Already Registered? Login Here<br/>
</form>
deregisterform.html
<form action="users.php" method="DELETE">
Username: <input type="text" name="uname" /><br />
Password: <input type="password" name="pass1" /><br />
Confirm Password: <input type="password" name ="pass2" /><br />
<input type="submit" value="Deregister" name="sub" />
</form>
register.php
<?php
if(isset($_POST['uname']) && isset($_POST['fname']) && isset($_POST['lname']) && isset($_POST['tel']) && isset($_POST['dob']) &&
isset($_POST['email1']) && isset($_POST['email2']) && isset($_POST['pass1']) && isset($_POST['pass2']))
{
//take values from http POST and trim whitespace
$uname = trim($_POST['uname']);
$fname = trim($_POST['fname']);
$lname = trim($_POST['lname']);
$tel = trim($_POST['tel']);
$dob = trim($_POST['dob']);
$email1 = trim($_POST['email1']);
$email2 = trim($_POST['email2']);
$pass1 = trim($_POST['pass1']);
$pass2 = trim($_POST['pass2']);
//validate the data from the form
if($um->isNameFormatted($uname))
{
if(!$um->isUserExists($uname)) //does user already exist with this username?
{
if($um->isNameFormatted($fname)) //first name formatted correctly
{
if($um->isNameFormatted($lname)) //last name formatted correctly
{
if($um->isDOBFormatted($dob))
{
if($email1 == $email2)
{
if($pass1 == $pass2)
{
if($um->isPasswordClean($pass1))
{
if($um->isTelephoneVerified($tel))
{
//everything is OKAY --- PROCEED WITH ADDING USER
$user = $um->registerUser($uname,$fname,$lname,$dob,$tel,$email1,$pass1);
if(isset($user))///
{
//successful registration
$response["error"] = false;
$response["id"] = $user;
echo json_encode($response);
}
}
}
}
}
}
}
}
}
}
}?>
deregister.php
<?php
if(isset($_POST['uname']) && isset($_POST['pass1'] && isset($_POST['pass2'])
{
$uname = $_POST['uname'];
$pass1 = $_POST['pass1'];
$pass2 = $_POST['pass2'];
if($um->isUserExists($uname))
{
if($pass1 == $pass2)
{
if(true)//$um->isPasswordFor($uname, $pass))
{
$um->deregisterUser($uname, $pass1);
$response["error"] = false;
$response["text"] = "User removed!";
echo json_encode($response);
}
else
{
$response["error"] = true;
$response["text"] = "Wrong username and password combination!";
echo json_encode($response);
}
}
else
{
$response["error"] = true;
$response["text"] = "Passwords don't match!";
echo json_encode($response);
}
}
else
{
$response["error"] = true;
$response["text"] = "User(".$uname.") not in database!";
echo json_encode($response);
}
}?>
users.php
<?php
error_reporting( -1 );
require('userManagement.php');
$um = new UserManagement();
$response = array("error" => FALSE);
//check if user logged in and authenticated
if(true)
{
echo "user logged in.";
echo $httpVerb = trim(strtoupper($_SERVER['REQUEST_METHOD']));
switch($httpVerb)
{
case "GET":
$response["error"] = false;
$response["httpVerb"] = $httpVerb;
echo json_encode($response);
break;
case "PUT":
$response["error"] = false;
$response["httpVerb"] = $httpVerb;
echo json_encode($response);
break;
case "POST":
include('register.php');
break;
case "DELETE":
include('deregister.php');
break;
default:
echo "http verb ".$httpVerb." is not supported for this resource.";
$response["error"] = true;
$response["httpVerb"] = $httpVerb;
echo json_encode($response);
break;
}
}
else
{
echo "need to login first.";
}?>
Any ideas what i'm doing wrong?

Answer 1

You can't use DELETE as a form action.
From the specs, we have:
The method and formmethod content attributes are enumerated attributes
with the following keywords and states:
The keyword get, mapping to the state GET, indicating the HTTP GET method.
The keyword post, mapping to the state POST, indicating the HTTP POST method.
The invalid value default for these attributes is the GET state.