|
Wednesday, 11 March 2009
|
What are forms?
Forms in HTML documents
Proceed in php
Text input fields
Drop-down lists
Radio and checkboxes
Trust no one
Magic Quotes
1. What are forms?
Many internet pages provide areas which can be filled or text selections can be made. After that there is typically a button called Submit These areas are called forms. These informations are entered send to a php script and this script use this value like adding a new user or news.
2. Forms in HTML documents
Forms are created with the <form> tag. The action attribute points to the url where the form is send to, in your case your php script. This script is opened with the data entered so redirects the browser to the php script.
You can with the specific method attribute how the data are send to the php script. If this value is get the data are send over the url, like a simple request to index.php? index.php?section=news = index.php?section=news The values are added to url. As this can result in a long url its more common for forms to use the value post With this value the form send data is hidden inside the HTTP request. The data itself are readable (they are not encrypted somehow) but are not visible to the user. So the form is eg just send to http://www.example.com/login.php date but the form are transmitted hidden.
3. Proceed in php
To access the form data in php you must give the form fields in your html code a name with the name attribute. Inside your php script form the data are saved in the super global arrays $ _GET or $ _POST, depending on which method is used. The index of the array field is the same as the name in the form field, the value is filled from the given form field.
The name of the form field can also be an array field. If the attribute name="foobar[5]" = name="foobar[5]" is used php to create a corresponding array field $ _POST [ $_POST['foobar'][5] If the index is omitted name="foobar[]" = name="foobar[]" []") to array field is created like $ $array[] = 'value'; [] = $array[] = 'value'; This is used for check boxes which will be stored in one array.
4. Text input fields
For one line input field you can use the html tag <input>. For simple text inputs use the attribute type="text" = type="text" for use passwords type="password" = type="password" Note that send passwords are not encrypted, the form field just shows * instead of the actually password. If you want multi-line input fields use <textarea> instead.
<form action="script.php" method="post">
<fieldset>
<legend> Enter login </ legend>
<label> Username: <input type="text" name="Username" /> </ label>
<label> Password: <input type="password" name="Pass" /> </ label>
<input type="submit" name="formaction" value="Login" />
</ fieldset>
</ form>
If you send this form to get the php array folloing fields.
<? php
$ _POST [ 'Username'] = / * input from the user name field * /;
$ _POST [ 'Pass'] = / * input from the field pass * /;
$ _POST [ 'Form action'] = 'Login'; / / set with the value = "" attribute
?>
5. Drop-down lists
Drop-down lists are created with the <select> and <option> tags. You should add [] after the name of the drop-down list if you want to use the attribute multiple="multiple" = multiple="multiple" This way all selected entries are saved in an array.
<form action="script.php" method="post">
<fieldset>
<legend> form for foobar </ legend>
<label> Name: <select name="Username">
<option value="1"> Blabli </ option>
<option value="4"> Test User </ option>
</ select> </ label>
<label> rights: <select name="Rights[]" multiple="multiple" size="5">
<option value="1"> News </ option>
<option value="2"> Forum </ option>
<option value="3"> Guestbook </ option>
</ select> </ label>
<input type="submit" name="formaction" value="Send" />
</ fieldset>
</ form>
If you select the user Blabli rights and select the News and Guestbook array the following fields will be created.
<? php
$ _POST [ 'Username'] = "1";
$ _POST [ 'Rights'] [] = "1";
$ _POST [ 'Rights'] [] = "3";
$ _POST [ 'Form action'] = "Send";
?>
6. Radio and checkboxes
For radio and checkboxes you can use the <input> tag. Depends on what you want you must use type="radio" = type="radio" or type="checkbox" = type="checkbox" The checkboxes or radio buttons, which belongs together must have the same name. For checkboxes the name should end with [] to get an array of all selected check boxes.
<form action="script.php" method="post">
<fieldset>
Select <legend> pizza </ legend>
<fieldset>
<legend> Size </ legend>
<label> <input type="radio" name="Size" small value="20" /> </ label>
<label> <input type="radio" name="Size" medium value="24" /> </ label>
<label> <input type="radio" name="Size" big value="30" /> </ label>
</ fieldset>
<fieldset>
<legend> Topping </ legend>
<label> <input type="checkbox" name="Topping[]" value="salami" /> salami </ label>
<label> <input type="checkbox" name="Topping[]" value="thunfish"> tuna </ label>
</ fieldset>
<input type="submit" name="formaction" value="Order" />
</ fieldset>
</ form>
If you order a medium pizza with salami and tuna you will get the following array fields.
<? php
$ _POST [ 'Size'] = "24";
$ _POST [ 'Topping'] [] = "salami";
$ _POST [ 'Topping'] [] = "tuna";
$ _POST [ 'Form action'] = "Order";
?>
If you dont value for a specific radio or check boxes will be the value on If a check box is not selected its not send at all
7. Trust no one
As GET variables like the form data is from external source. These can be filled with every value, even with javascript code. You must check the value inside your php script. Use the isset function to check if the form data exists.
<? php
if (! isset ($ _POST [ 'name'], $ _POST [ 'password'])) (
die ( 'only use forms from the homepage.');
)
?>
The content can always be checked with string functions.
8. Magic Quotes
If you send data from a text form to a php script it can be possible that the data is changed automatically by your php script. The text A sample text with one ' and one " will be converted to A sample text with one \' and one \" \ A sample text with one \' and one \" \ ". This is called Magic Quotes. It was implemented to help beginners which want to save these values inside a database.
But this may be get annoying, at least if you get outputs like A sample text with one \\\\\\' and one \\\\\\" \ \ \ \ \ \ A sample text with one \\\\\\' and one \\\\\\" \ \ \ \ \ \ ". So we delete this backslashes with stripslashes if magic quotes is activated on your server.
<? php
if (get_magic_quotes_gpc ()) (
$ in = array ($ _GET, & $ _POST, & $ _COOKIE);
While (list ($ k, $ v) = each ($ in)) (
Foreach ($ v as $ key => $ val) (
If (! Is_array ($ val)) (
$ in [$ k] [$ key] = stripslashes ($ val);
Continue;
)
$ in [] = & $ in [$ k] [$ key];
)
)
Unset ($ in);
)
?>
|
