Protect values after form submission codeigniter - php

What I am trying to do is show the form validation errors if there are any and prepopulcate the form.
View
<input type="hidden" value="<?php echo $_GET['project_id']; ?>" name="project_id" id="project_id">
<input type="text" value="<?php echo set_value('name'); ?>" name="name" id="name">
Controller
$validation_rules = $this->access_m->rules;
$this->form_validation->set_rules($validation_rules);
if($this->form_validation->run()){
// process the form
}else{
$data= array(
'subview'=>'access/access',
);
$this->load->view('layout', $data, FALSE);
}
Now what the problem is, I can prepopulate the value for the name, but how do I prepopulate the value for the project_id field. Since the value for the field is extracted from the GET method, is there any way I can pass it back to the view so that I can use it again.
I could use a redirect and add the project ID to the url as example.com/access?project_id=23 but then I would loose the values to prepopulate to the rest of the form fields.
Any solutions ??

Create method that accepts parameters example.ufo/controller/accept/<id>
From now on you don't need hidden field, your id is accesible within the method more info is here http://ellislab.com/codeigniter/user-guide/general/controllers.html#passinguri
example:
<?php
class User extends CI_Controller {
public function accesible( $id = false) {
//necessary checks, is id valid? is it numeric? is id in database?... does user have permission to work with element with this ID?
echo $id;
}
}
?>

Related

How do I make a Save button for my project in laravel

I am making a site for drawing in laravel and I don't know how to make a save button for my drawings,all I need to save for now are the name of the canvas and the size of it,one problem is that the name is stored in an input and I don't know how to access it,the other what do I return after saving it
<a href="{{route('canvas.save',['size' =>$size])}}">
This is how I transfer the size,but the name I don't know yet how to transfer
this is the input where I store it
<input oninput="ChangeInput(this.value)" value="Canvas" type="text" name="title" id="title">
this is how I add the data to the table
public function createDrawing($name,$size,$id){
return Drawing::create([
'name' => $name, //the name of the canvas
'canvas_size' => $size,
'users_id' => $id //this is a foreign key
]);
}
the structure of the route is
Route::get('canvasSave/{size}',[CustomAuthController::class,'SaveDrawing'])->name('canvas.save');
public function SaveDrawing($size){
$check = $this->createDrawing(...,$size,1);
//how do I get the name here from the input
}
What do I return after creating the drawing was stored in the table,my idea was to return a Partial view like a Popup but still don't know how to do it,
I just dont understand how to save it via routes and I'm confused,your help would help a lot
So I managed to do the saving like this in the controller
public function createDrawing(array $data){
return Drawing::create([
'name' => $data['title'],
'canvas_size' => $data['size'],
'users_id' => $data['users_id']
]);
}
public function SaveDrawing(Request $request){
$data = $request->all();
$data['users_id'] = Auth::id();
$check = $this->createDrawing($data);
return View('main.introduction');
}
I did the route into the post like you said and things got clearer after I made the html in form
route:
Route::post('canvasSave',[CustomAuthController::class,'SaveDrawing'])->name('canvas.save');
HTML:
<form action="{{route('canvas.save')}}" method="POST">
#csrf
<input oninput="ChangeInput(this.value)" value="Canvas" type="text" name="title" id="title">
<input type="hidden" name="size" value="{{$size}}">
<button type="submit">Save</button>
</form>
after the save it just returns back to the main page
Use Route::post and pass all the data as a payload (body) on the request. Τhe easiest way is to add them in a form and the size can be a hidden input with the value or use a javascript ajax method to pass them as you like.

Codeigniter - How to set name property from database

I'm using CodeIgniter and I have 2 questions:
How do I call result from model to name property in any form inputs?
How do I get the dynamic name property posted in Controller?
This is what I tried in my HTML:
<input type="text" name="saa_<?php echo $row1['Tube_No']; ?>" value="<?= $row1['Pin_No']; ?>">
And this is what I tried in my controller:
$data = array(
'SA_No' => $this->input->post('saa_.$row1'),
);
How do i get my form input name property get posted to controller.
First you need to get the value of $row1['Tube_No']
$valueDefinedWhenRenderingTheView = $row1['Tube_No'];
then you need to access it like this:
$data = array(
'SA_No' => $this->input->post('saa_' . $valueDefinedWhenRenderingTheView)
);
because, when your defining the input name to be the concatenation of "saa_" and the value of $row1['Tube_No'].

How to save dynamical fields data to database in laravel5

How to save dynamical fields to database the problem is i don't know the names of fields we have module the user will add fields with name dynamically and i will save that fields names in database when the user checks the form for example he added fields in posts form so i want to save that fields data to database.Here's my code
<form>
<input type="text" name="firstname" id="firstname">
<?php foreach($extrafields as $extrafields1 )
{
?>
<input type="<?php $extrafields1->type; ?>" name="<?php $extrafields1->name; ?>" id="<?php $extrafields1->id; ?>" <?php $extrafields1->extraparameters; ?>>
<?php
}
</form>
If you can't define the name of the columns in the database, you'll have to save the data as JSON. So you'd create a column on your model called extra_parameters that would be a text column. When you post the form data, you'd need to update the model something like this:
//remove the expected parameters so you only have the extra ones
$extraparams = $request->except(['firstname','...']);
$model->extra_parameters = $extraparams;
You should also cast the column to an array in your model. This allows you to set $model->extra_parameters using an array, and it will automatically convert it to JSON when saving to the DB. It also lets you use $model->extra_parameters['param_name'] to access the fields.
//in your model file
protected $casts = [
'extra_parameters' => 'array'
];
see the array casting section here for more: https://laravel.com/docs/master/eloquent-mutators#attribute-casting

Yii - cannot define a safe array of attributes for form submit

I have a PHP form that need to submit a array of numbers, what we have in view:
<input type="text" id="ProductForm_sizeobj_1" name="ProductForm[sizeobj[1]]" value="13">
<input type="text" id="ProductForm_sizeobj_2" name="ProductForm[sizeobj[2]]" value="13">
<input type="text" id="ProductForm_sizeobj_3" name="ProductForm[sizeobj[3]]" value="13">
And I define in form class:
public $sizeobj = array();
public function rules() {
return array(
array('/** other attributes **/, sizeobj', 'safe')
);
}
Since "Sizeobj" is a dynamic attribute and the size will growth more then 3, therefore I use array. However after form submitted the error throw as follow:
Failed to set unsafe attribute "sizeobj[1" of "ProductForm".
I believe I might using the wrong method to setup array attribute, or wrong rule, any advice? I'm new to Yii, any help is appreciated.
Use name="ProductForm[sizeobj][1]" instead of name="ProductForm[sizeobj[1]]"

Should I use set_value() to repopulate a form in CodeIgniter

My question is whether I should use set_value() at all to re-populate a form. It might seem odd to say that, however I am creating a shared controller function and view which can be used to either add a new record or edit an existing one. It seems to make sense to do this since the functionality is so incredibly alike.
As such, if we call up an existing record to edit I do this:
$data['fields'] = $this->customer_model->get_customer($id);
If the form is submitted to save the record, or if we're adding a record for the first time, the form has the potential to reload if the user makes a mistake so I populate $data['fields'] this way instead:
$data['fields'] = array(
'company' => $this->input->post('company') ?: '',
'website' => $this->input->post('website') ?: '',
'credit_limit' => $this->input->post('credit_limit') ?: ''
);
My form element looks like this:
<input type="text" name="company" value="<?php echo set_value('company', $fields['company']); ?>" />
But I'm thinking it may as well look like this:
<input type="text" name="company" value="<?php echo escape_html($fields['company']); ?>" />
Since the form data could come from either user input (when adding or saving) or from the database (when retrieving a record to edit) I cannot rely entirely on post() or set_value() without the 2nd parameter. Furthermore, the second parameter for set_value() will always exist ($fields['company'] in this example) because it's initialized from the start, which is why I am thinking of just using it directly.
Is there a problem with this approach?
If you want to populate form fields on FALSE return of Form Validation or insert data for editing operations, I suggest you to use following helper:
Usage
<input type="text" name="last_name" value="<?=vset_value('last_name','',$rs);?>">
Explanation
$rs here is the $db data for record (if you are sending it to view). To stay at the safe side please include $this->data['rs'] = false; at your controller. If $rs is set and true, helper take results from it and display it. Otherwise it displays if the key exist in $_POST. If both don't exists, it display default value.
Helper
/**
* vayes_helper::vset_value
*
* Retains state of INPUT text after Form Validation
*
* #access public
* #param string name of INPUT tag
* #param string default value for INPUT tag
* #param mixed DB Result (array or object)
* #return string
*/
if(!function_exists('vset_value')) {
function vset_value ($name_of_input,$default_state='',$db_result_array='') {
$CI = &get_instance();
$render_state = $default_state;
if($CI->input->post()) {
$render_state = $CI->input->post($name_of_input);
} else {
if(is_object($db_result_array) && isset($db_result_array->$name_of_input)) {
$render_state = (isset($db_result_array->$name_of_input)) ? $db_result_array->$name_of_input : $default_state;
} else if($db_result_array != '' && array_key_exists($name_of_input,$db_result_array)) {
$render_state = (isset($db_result_array[$name_of_input])) ? $db_result_array[$name_of_input] : $default_state;
}
}
return $render_state;
}
}
If you like the way, let me know. I can supply for more form input type like select, checkbox, etc.
The approach is correct, as mentioned in the CodeIgniter docs. In fact, you don't need to include the second parameter in set_value.
set_value definition:
string set_value(string $field = '', string $default = '')
//$field: If there is a submitted field with this name, its value is returned.
//$default: If there is no matching submitted field, this value is returned.
Yes,You should.
set_value() is used to re-populate a form has failed validation.
There is no additional filtering on it, so it faster.
But, I prefer some times to use $this->input->post() for the secure.

Categories