ITM 352 More on Forms Processing
Different input types Here are the HTML form element input types you can use Text Password Hidden Radio Checkbox Submit Button Reset In addition, the compound types: <select> <textarea> <listbox>
Login program with Functions $usernames = array ( // Define valid user names and passwords 'Moe' =>'stooge1', 'Larry' => 'stooge2', 'Curly' => 'stooge3'); if (array_key_exists('submit_button', $_POST)) // Process the login { if (process_login($usernames) == TRUE) print "logged in " . $_POST['username']; } else print 'Incorrect password for ' .$_POST['username'] .'<br>'; display_login($usernames); } else
Display Login Function /* Display a login form with a select box of usernames */ function display_login($users) { echo "<form action = " . $_SERVER['PHP_SELF'] . " method = 'post'>"; echo "<select name='username'>"; foreach ($users as $user => $pass) { printf("<option>%s</option>", $user); } echo "</select>"; echo "<input type = 'password' name = 'password'>"; echo "<input type = 'submit' name = 'submit_button' value = 'login'>"; echo "</form>";
Process Login Function /* Checks the posted form to see if password entered matches * the password for the username (info in $users) selected in the * form. Returns TRUE if there is a match, FALSE otherwise */ function process_login($users) { if($users[$_POST['username']] == $_POST['password']) return TRUE; else return FALSE; } Do functions simplify or complicate? Why? What are the additional benefits of using functions?
Recap: Tips and Hints Use single ' ' on the inside, " " around the outside or vice versa Take advantage of PHP by using for/while/foreach to generate multiple form elements and compound types Quotes must be used around anything with spaces
Validating Form Data First check that form data was submitted, usually by using array_key_exists() to check for the submit button name Creating functions can be helpful for validation, especially when the validation needs to be done in different places or on forms: <?php function validate_price($value) { // Ensure that $value is a valid price if( !isset($errors)) $errors = array(); // init array if not defined already if( !is_numeric($value) ) $errors['not_number'] = "not numeric"; if( $value - round($value, 2) != 0 ) $errors['not_dollar'] = "not a dollar amount"; if( $value < 0 ) $errors['not_non-negative'] = "price cannot be negative"; return $errors; } ?>
Validating Form Data Sometimes you will see a variable declared as global so that it is accessible inside and outside of functions. Note how no return values are needed. But this bad programming practice, so avoid doing this! function validate_price($value) { // Ensure that $value is a valid price global $errors; // init array if not defined already if(!isset($errors)) $errors = array(); if( !is_numeric($value) ) $errors['not_number'] = "not numeric"; if( $value - round($value, 2) != 0 ) $errors['not_dollar'] = "not a dollar amount"; if( $value < 0 ) $errors['not_non-negative'] = "price cannot be negative"; }
Validating Form Data Validation can be a bit subtle at times given that values from forms are always passed as strings. Here's how you would test that a number input as a string is actually numeric: ctype_digit($a) Why won't is_int($a) work here?
Putting Errors in Their Place <?php define('MIN_PASS_LEN', 3); define('MAX_PASS_LEN', 10); function check_pass($pword, $errors) { // Ensure that the password is the right size if (strlen($pword) < MIN_PASS_LEN) $errors['password_short'] = 'Enter a longer password'; if (strlen($pword) > MAX_PASS_LEN) $errors['password_long'] = 'Enter a shorter password'; return $errors; } $username = 'user'; $password = 'pass'; $errors = array(); echo "<html><body>"; if (array_key_exists('form_data', $_POST)) { // The user entered a password; check it $errors = check_pass($_POST['password'], $errors); if (count($errors) == 0 && $_POST['username'] == $username && $_POST['password'] == $password) { echo 'correct!!'; } else echo 'wrong user or password!';
Putting Errors in Their Place // Now print out the form echo "<form action = " . $_SERVER['PHP_SELF'] . " method= 'POST'>"; echo "Username: <br>"; echo "<INPUT TYPE='TEXT' name='username' value = "; if (isset($_POST['username'])) echo $_POST['username']; echo ">"; echo "<br>Password: <br>"; echo "<INPUT TYPE='password' name = 'password'>"; // Put an error message by the offending password field if (isset($errors['password_short'])) echo " <font color='red'>{$errors['password_short']}</font>"; if (isset($errors['password_long'])) echo " <font color='red'>{$errors['password_long']}</font>"; echo "<br><br>"; echo "<INPUT TYPE='HIDDEN' name = 'form_data' value='submitted'>"; echo "<INPUT TYPE='SUBMIT' name = 'submit'>"; echo "</form></body> </html>"; ?>
Different input types Hidden Text Password Radio Checkbox Submit Button Reset In addition, the compound types: <select> <textarea> <listbox>
Passing Hidden Post values To pass a value from one page to another you can use the hidden input type Only string values can be passed => must convert everything to a string The urlencode(), serialize() functions may be useful for converting compound values such as arrays into stings. Use urldecode(), unserialize() to recover the original value from the string passed into the $_POST or $_GET array
Hidden Input Type <?php $purchase = array('thing one', 'thing two'); ?> <form action= "<?php $_SERVER['PHP_SELF'] ?>" method='POST'> <input type='hidden' name='secret' value=96> <input type='hidden' name='purchase' value='<?= urlencode(serialize($purchase)) ?> ' > <input type='submit' value='Submit'> </form> After submitting… $_POST['secret'] = ??? $_POST['stuff'] = ?? $purchase = unserialize(urldecode($_POST['purchase'] ));
Variables Information from a web server is made available through EGPCS Environment, GET, POST, Cookies, Server PHP will create arrays with EGPCS information $HTTP_COOKIE_VARS, $HTTP_GET_VARS, $HTTP_POST_VARS, etc. The 'HTTP' and '_VARS' can be dropped if desired These arrays are 'global' even inside functions PHP also will define $_SERVER['PHP_SELF'] that refers to the current script file which is useful for self-processing forms
Server Info A ton of information about the server and current browser is made available in the $_SERVER array SERVER_NAME REQUEST_METHOD QUERY_STRING REMOTE_ADDR PHP_SELF ….
Review: Request Methods There are two basic methods for getting data from an HTML form into PHP GET and POST What's the difference? GET will encode all data into a query string that is passed with the URL to the action page. This allows data to be bookmarked by the user. POST will pass data via the server’s environment variables. Data is not seen directly by the user
HTTP Basics Web pages are requested by a browser by sending HTTP request messages Includes a header and a body Uses a method such as GET or POST Asks for an address of a file (usually a path) Sample HTTP request: GET /index.html HTTP/1.1
Header Modification Sometimes you will need to intercept and modify the GET HTTP request before it is processed. Use the header() function to do this Be sure no output is displayed before sending headers or you'll get a message something like this : Warning: Cannot modify header information - headers already sent by (output started at D:\Program Files\nusphere\phpED\Projects\oldpage.php:3)
Example: Header Forwarding You can forward (redirect) users to a different page using the header() function. header('Location: http://mysite.com/myfile.php'); This will substitute the current header with 'Location: http://mysite.com/myfile.php' Effect is that the page myfile.php will be loaded Tip: always include the protocol such as http:// or file:// to be sure you specify exactly what you want
More Header Examples Passing values into the $_GET array during a redirect header('Location:myfile.php?name=Frankie& score=98&grade=A'); To deny access to a page if not authorized (more on this in later classes) header('WWW-Authenticate:Basic realm="My Website"'); header('HTTP/1.0 401 Unauthorized');
Implementing Back Buttons Also notice the different ways of using back buttons Hyperlink <A href="<?php echo $_SERVER['HTTP_REFERER']; ?>">BACK</A> Submit Button <form action='<?= $_SERVER['HTTP_REFERER'] ?>'> <INPUT TYPE="SUBMIT" value="back"> </form> Java script history action on button <FORM> <INPUT TYPE="button" VALUE="Back!" onClick="history.go(-1)"> </FORM>
Opening New Window Sometimes you want to have the Action of a form open a new window rather than replace the existing one <FORM action="./action_process.php" method="POST" target="_blank"> <INPUT TYPE="TEXT" name="stuff_input_field"> <INPUT TYPE="SUBMIT" value="Open New Window"> </FORM> ./action_process.php <?php echo 'You entered ' . $_POST['stuff_input_field']; ?> What do you think would happen if you used <FORM action="<?= $_SERVER['PHP_SELF'] ?>" method="POST" target="_blank">
Arrays in HTML forms Naming form elements within the same form with the same names and []'s will make an array (any input type). Elements are only those values that are non-empty. <FORM action="<?php $_SERVER['PHP_SELF'] ?>" method='post'> <INPUT TYPE="TEXT" name="a[]"> <INPUT TYPE="SUBMIT"> </FORM> <?php var_dump($_POST); ?>
Associative Array of Input Types Even better: specifying index values inside the []'s will be keys for the array (useful for directly associating selection with array data) <FORM action="<?php $_SERVER['PHP_SELF'] ?>" method='post'> <INPUT TYPE="TEXT" name="a[‘name’]"> <INPUT TYPE="TEXT" name="a[‘price’]"> <INPUT TYPE="TEXT" name="a[‘description’]"> <INPUT TYPE="SUBMIT"> </FORM> <? var_dump($_POST); ?>
Using Indexed Arrays to Generate Form Elements Using particular integer values inside the []'s will explicitly associate an index with the value in the array (this is really the same as an associative array) <FORM action=”<?php $_SERVER['PHP_SELF'] ?>” method='post'> <?php var_dump($_POST); $size = 10; for($i=0; $i<$size; $i++){ echo "<br>checkbox $i <INPUT TYPE='CHECKBOX' name='check[$i]'>"; } ?> <INPUT TYPE="SUBMIT"> </FORM> Useful for when you want to know exactly which input items are non- empty (in the above example, which checkboxes were checked)
Making HTML Forms 'Sticky' Whenever a <form> is processed, the values of its elements are initially empty Sometimes you want to keep a form element value around after a submit (e.g. for fixing a user-entry error or for remembering a user’s preferences) To make a form value 'sticky' you must get the information submitted and set it as the value for the form element: <FORM action=”<?php $_SERVER['PHP_SELF'] ?>” method='post'> <br> <input type='TEXT' name='textbox' value= “<? if(isset($_POST['textbox'])) echo $_POST['textbox'] ?>”> <INPUT TYPE="SUBMIT"> </FORM>
Example: Using HIDDEN to pass data through a page Select_quantities.php <form action='login.php' method=POST> <input type=text name=quantity1> <input type=text name=quantity2> <input type=submit name=submit_button> </form> login.php <?php $login_successful = array_key_exists('login_submit_button', $_POST); if ($login_successful == TRUE) { $query_string = "quantity1={$_POST['quantity1']}&quantity2={$_POST['quantity2']}"; header("Location: invoice.php?$query_string"); }?> <form action='<?php print $_SERVER['PHP_SELF']; ?>' method=POST> Username:<input type=text name=username_textbox> Password:<input type=password name=password_textbox> <input type=submit name=login_submit_button> <input type=HIDDEN name=quantity1 value='<?php print $_POST['quantity1']; ?>' > <input type=HIDDEN name=quantity2 value='<?php print $_POST['quantity2']; ?>' > invoice.php print "quantity1 is {$_REQUEST['quantity1']} and quantity2 is {$_REQUEST ['quantity2']}";
Example: passing a query string while using POST <form action='<?php print $_POST['PHP_SELF'] . "?" . $_SERVER['QUERY_STRING']; ?>' method=POST> Username:<input type=text name=username_textbox> <Password:<input type=password name=password_textbox> <input type=submit name=login_submit_button> </form>
Example Advanced HTML Form Processing: Checkbox Array <?php if (array_key_exists('a', $_POST)) { $selections = $_POST['a']; foreach ($selections as $key => $value) if ($selections[$key] == 'on') echo "<br>you selected box $key"; exit; } ?> <FORM action="<?php print $_SERVER['PHP_SELF'] ?>" method='post'> // Create an array of checkboxes for ($i = 0; $i < 5; $i++) { echo "<br>checkbox $i <INPUT TYPE='CHECKBOX' name='a[$i]'>"; ?> <br> <INPUT TYPE="SUBMIT"> </FORM>