Form data in GET (but method=post!)

Posted data override URL variables

[Notawiz]

I start with a page with an URI like this:
path/script.php?action=compose&projectid=1&detailid=9#compose_pane

On that page I have several items, among which a small mail form like this:

<td><a name="compose_pane"></a>
<form action="path/script.php?projectid=1&amp;detailid=9&amp;action=compose2#compose2_pane" method="post" name="msg_form">
<a href="path/script.php?projectid=1&amp;detailid=9#inbox_pane">Close compose view</a>
<table>
<tr>
<td>Subject:</td>
<td><input type="text" name="subject" size="40" value="" /></td>
</tr><tr>
<td>To:</td>
<td><input type="hidden" name="to" value="3"><input type="text" name="to_name" size="40" value="Some name" disabled /></td>
</tr><tr>
<td valign="top">Message:</td>
<td><textarea rows="10" cols="45" name="message"></textarea></td>
</tr><tr>
<td colspan="2"><div class="fbuttn"><div><input type="submit" value="Send Message" id="msg_submit" /></div></div></td>
</tr></table>
</form>
</td>

The "path/script.php" thing is generated by the following:

echo "<form action=\"".$_SERVER['PHP_SELF']."?projectid=$projectid&amp;detailid=$detailid&amp;action=compose2#compose2_pane\" method=\"post\" name=\"msg_form\">\n";

When I hit the button to send the mail, I should stay on my current page, with some action done inside an:

if ($action==compose2) {
//handling of the data
}

Instead, I have a completely empty page, with this URI:
path/script.php?subject=&to=3&message=#compose_pane

Any idea why my GET variables "projectid", "detailid" and "action", and my anchor "#compose2_pane" are now all of a sudden replaced by the POST variables "subject", "to" and "message" an the "old" anchor "#compose_pane"?

To end with, the weirdest thing about this, is that I copied this script from another form I wrote last year, and there it worked. The only differences are the names of the variables.

I also tried to "unset" the $_GET superglobal at the beginning of the script, in case there were some kind of inheritance, but that made no difference whatsoever.

Can anyone give me some hints about where to look for to debug this odd behaving piece of script?

Many thanks.
Notawiz

[mincklerstraat]

Try replacing:

if ($action==compose2) { 
//handling of the data 
}  

with:

if ($_GET['action']=='compose2') { 
//handling of the data 
} 

or maybe:

if(isset($_GET['action']) && strpos(' '.$_GET['action'], 'compose2')){ 
//handling of the data 
} 
// 

It looks like you are probably expecting this script to be running with register_globals on. However, when this is on, remember that get, post, cookie, and session all share this namespace - the variables 'coming in' could be from any of these places. The order in which these variables are written can be seen in the php configuration 'variables_order', which is by default "EGPCS" - meaning environment, get, post, cookie, server - in this default config, P comes after G, so post will overwrite GET variables.

Best just to write your script stipulating which branch of input you wish to use. And remember, having register_globals on has serious security consequences.

I suggest the second since it looks like in your url you're adding some stuff to the 'action' parameter.

Also, key names in arrays are strings so should be put between quotes. You probably didn't write this script with

error_reporting(E_ALL)

.

[Notawiz]

Hello mincklerstraat,

Unfortunately, the script doesn't even go that far as the "if" statement with $action as parameter, because on submission of the form, the URI is wrong.

See, the projectid, detailid stuff is needed to query the DB.
If number of rows > "0", we have a very large "if" statement, of which the mail form is just a (nested) small part.

You are right about the single quotes, but even without those the same script worked on another very large page, also built from GET variables (only difference=names of the POST or GET variables).

Could it be that my whole script gets confused because the local variables and the global variables are identical?
$detailid=$_GET['detailid']; etc...

As for the register_globals on, hey that's not my fault, since our shared host rules that...

Notawiz

[dmmh]

s for the register_globals on, hey that's not my fault, since our shared host rules that...

true, but you need to account for it...you cant just do :shrug: and stick to using the variables the way you are now.

either first initailse the variables ($action = $_POST['action'];), or use them properly (if ($_POST['action'] == 'compose2'))

lose everything after .php in action="path/script.php?projectid=1&detailid=9&action=compose2#compose2_pane"

furthermore, Id use hidden fields.
make a hidden field , name it action, use value="<? echo $_GET['action'];?>", repeat it for the rest of what you need and it will do what you want

you get the type of action anyway, via the url, no need to include it in the form's action. next you can echo it in an hidden field with $_GET and on submitting you access it via $_POST, since thats the form method

you need to sort your way of thinking :)

[mincklerstraat]

Yes, then wherever there's stuff that comes in via a url or a get form, use $_GET['var'] instead of $var and these will be available to you again. dmmh is right-on here - it's still best practice even when register_globals is on, you just have to be doubly sure that all variables are properly initialized with register_globals on. Also, you can turn them off if you want in an htaccess file. Try using $_GET['var'] format, see how it goes, and report back.

[Notawiz]

Hello dmmh,

First of all, I already initialise the variables, no matter if they were passed as GET from the previous page or from the PHP_SELF reload of the current page:

$detailid=$_GET['detailid'];
$projectid=$_GET['projectid'];

Using hidden fields: means turn ALL the links in the website into buttons of a form, and that's a lot of work.

In the case of links the GET method seems just the most appropriate way to pass data to another page.

But, since the very same logic worked perfectly in the admin part of the website (with other variables), it should work in the members area.
What I mean is that there must be a silly mistake, not worth a complete revolution of this huge website.

The problem is that, since no content loads at all, I'm not able to echo the output, which could help debugging this.

And, as mincklerstraat said, the POST comes after the GET, so for some reason no GET is fed to the browser along with the PHP_SELF statement, and then the POST takes up the place left empty by the missing GET parameters.

I'm not good enough in coding to understand why this happens, since the link in the form action is correct (I copied it in the first thread above), but once the button is clicked, it goes wrong...

Any leads?

Notawiz

[Notawiz]

Guys, is it my bad English or what, but I believe you're on the wrong track :-)

I said already that I:
1. initialise the variables;
2. unset the superglobal $_GET to make sure.

It must then be something else confusing the parser, but what?

Notawiz

[Notawiz]

Just to narrow down the odds, I edited the page a little.

First, I renamed the local variables:

$project_ID=$_GET['projectid'];
$detail_ID=$_GET['detailid'];

so as to avoid any confusion between them.

Next, in the mail form, I passed as hidden fields the variables projectid, detailid and action.
Thus within the <form> tag I only have my anchor:

echo "<form action=\"".$_SERVER['PHP_SELF']."#compose2_pane\" method=\"post\" name=\"msg_form\">\n";

After hitting the submit button, the if($action=='compose2') statement is executed.

But things are still terribly wrong, because:
1. in the address bar, the URI is just a complete mess:
path/script.php?subject=&projectid=1&detailid=9&action=compose2&to=3&message=#compose_pane

why do the POST variables appear here?
and why is this the wrong anchor? (compose_pane instead of compose2_pane)

2. To cross check things, I always echo my arrays in debug mode. And here I have no POST array at all, it is not that it's empty, is simply does not exist!
The GET array is an empty one, which seems logical, since I unset that on top of the script.

It seems as if the complete POST function has been disabled. But I use the same development environment as last year.

The only thing is that I upgraded from FireFox 0.8 to Firefox 1.0.

I'm completely lost. I would greatly appreciate any help.

Notawiz

[dmmh]

Guys, is it my bad English or what, but I believe you're on the wrong track :-)

I said already that I:
1. initialise the variables;

Notawiz

I must be really missing something here....read over the topic a few times but imo you didnt say it nor does your code implicate you do :)

Im gonna take a good look into this...hope I can find something. I had a similar problem myself once...also shared host (for now)

and:

Using hidden fields: means turn ALL the links in the website into buttons of a form, and that's a lot of work.

its the same amount of work as modifying the post url..well, almost
but I can see why you dont want to change the way you handle things...if its worked sofar :)

[dmmh]

this beats me totally..I just cant handle the way you access your variables, it is so confusing to me, sorry. Also, I drank a few beers lol :D

anyway, as for unsetting the $_GET array.....this doesnt help very much...you rely on $_GET variables to generate a URL to submit to for you yet you unset it. Or maybe I just dont get it anymore...Im so confused :S

[Notawiz]

Hello back dmmh,

Please stop worrying, I've found the mistake :-((

Shame on me, but due to extensive copy&paste, I've nested this little mail <form> within another <form>.

That's why it didn't work.
Once I closed the main <form>, of course everything got in place as expected.

To my credit I must say that I have 1331 lines of code here, so it was not easy to spot my error.

Thanks for thinking with me on this case.
I hope some day I'll be good enough to help other people.

Have a nice WE.
Notawiz

[dmmh]

glad you got it sorted man...

the simplest thing can keep you busy for days :S

[mincklerstraat]

Pretty much in agreement with dmmh here, 'cept in my case it's bourbon.

<form action=\"".$_SERVER['PHP_SELF']."#compose2_pane\" method=\"post\" name=\"msg_form\"> - in this version, you aren't setting any get parameter for action, so $_GET['action'] won't be available, and $action won't either, unless you have put this into a $_POST field (btw not a bad idea - why not just put the stuff you want in $_GET into hidden fields or something? this won't 'make a button', you might want to do a bit of a refresh on HTML forms if this confuses you).

your #2:
you mention echoing an array, and not getting anything for $_POST - if $array is a really honking big array, and you do:
echo $array;
you won't get the contents of the array. What you need to do is:
echo '<pre>'; // the pre formatting tag makes it nice to read
print_r($array);
echo '</pre>';

If you really still are very very confused, don't feel ashamed to find a 'real person' (all us here on the php forum are just bots that jatar runs off an ancient Sparc server parked in an abandonned icehockey arena). No really, somebody who can look at your code where you are, point stuff out to you, and talk in 'real time' - sometimes discussing things on forum boards just doesn't cut it, you need a bit more substance, explanation, on both sides - and there's only so much you can do here to describe your problem.

<edit>you guys post too fast, Notawiz, congrats on getting things sorted.</edit>

[Notawiz]

mincklerstraat,

(all us here on the php forum are just bots that jatar runs off an ancient Sparc server parked in an abandonned icehockey arena)

Very funny, made my day (and that of jatar_k also, I guess)

Notawiz

[jatar_k]

>> all us here on the php forum are just bots that jatar runs off an ancient Sparc server parked in an abandonned icehockey arena

it's a 280R with an UltraSPARC III but hey, who's checking ;)