PHP post request with curl and hidden values - php

Question

I'm currently trying to send POST data to a URL via curl. The URL that the data is sent to is the URL on which the form is located on. In other words the form "action" is itself.
The problem is, on the form page, a random hidden input value is set on each refresh, and I need to get those values, and use them alongside the other data I want to post. Here is my current code:
<?php
function httpPost($url,$params) {
$postData = '';
$proxy = "127.0.0.1";
$port = "9150";
// Create name value pairs seperated by &
foreach($params as $k => $v) {
$postData .= $k . '='.urlencode($v).'&';
}
rtrim($postData, '&');
$ch = curl_init();
curl_setopt($ch,CURLOPT_URL,$url);
curl_setopt($ch,CURLOPT_RETURNTRANSFER,true);
curl_setopt($ch,CURLOPT_HEADER, false);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
curl_setopt($ch, CURLOPT_POST, count($postData));
curl_setopt($ch, CURLOPT_POSTFIELDS, $postData);
curl_setopt ($ch, CURLOPT_PROXYTYPE, 7 );
curl_setopt ($ch, CURLOPT_PROXY, $proxy.':'.$port );
$output=curl_exec($ch);
curl_close($ch);
return $output;
}
$content = file_get_contents('https://secured.example.com/directory/create');
$params = array(
"name" => "Name",
"pass" => "password",
"email" => "email#email.com"
);
echo httpPost("https://secured.example.com/directory/create",$params);
?>
For instance, on https://secured.example.com/directory/create there is a hidden input field that looks like this:
<input type="hidden" name="anon_token" value="ZHvR0DtwB-15Os0qwdVE3IN_ygSHHhllDAkOUwVPtZE" />
However, the value is randomly set each time (refresh).

Answer 1

After fetching the content, you need to grab the value of anon_token.
This basically uses the content of the HTML page as new DOMDocument.
Then all input tags are fetched, to find the one input tag containing "anon_token".
From this tag you want the value (which is the token).
The token needs to be inserted into the POST data array.
Side-note: a simple preg_match might work, too. But, anyway let's play it safe by using Dom-functions.
$content = file_get_contents('https://secured.example.com/directory/create');
$doc = new DOMDocument();
$doc->loadHTML($content);
$tags = $doc->getElementsByTagName('input');
foreach ($tags as $tag) {
if($tag->getAttribute('name') === 'anon_token') {
$token = $tag->getAttribute('value');
}
}
$params = array(
"name" => "Name",
"pass" => "password",
"email" => "email#email.com",
"anon_token" => $token
);
With preg_match()..
preg_match('/name="anon_token"\svalue="(.*)"/', $content, $matches)
$token = $matches[0];

Answer 2

Hope this works:
$content = file_get_contents("https://secured.example.com/directory/create");
$pattern = "/hidden.*name=[\s|'|\"]anon_token.*value=.*[\"']/";
preg_match( $pattern , $content , $matches);
$pattern_value = "/hidden.*name=[\s|'|\"]anon_token.*value=/";
foreach($matches as $match){
echo preg_replace(array($pattern_value, "/'/" , '/"/') , array( "", "" , "") , $match);
}