Autofill and submit in background?

[monolift]

I have a client that owns a travel agency. They get commission if sales are made on a flight booking site with their username and password.

Is there a way to automatically send the username and password to a form, submit it and then confirm (all in the background)?

The login process consists of 2 screens. 1 screen to enter and submit. 1 screen to confirm. Then the booking screen.

The whole thing is done in CGI with html pages dynamically created.

[jatar_k]

You should be able to do that but you would have to write it into the script. An if statement that covers that possibilty.

Maybe a little more info on it might be good, I don't 100% understand what you want to do.

[monolift]

Unfortunately I do not have the script. The client is a travel agent. If they log in to, let's say Virgin Airlines booking system, with their agent ui/pw they get commission. They would like people to be able to click a link and have the username and password automatically sent so that anyone can book through the Virgin system and the travel agent will get the commission.

I thought it might be possible to send the variables in the url, but that doesn't seem to work.

[dingman]

Perhaps a form with a "post" method and the same "action" field as the login form, and and a pair of hidden inputs with the username/password? I don't like the idea at all, since it involves sending the username and password to the client first, but your attempt to do it with the URL is just as bad on that front.

Why not collect the relevant info from the client, process it, and then send your own http form request to the airline to do the actual booking? more work scripting it all, I know, but it doesn't expose the username/password to all and sundry.

[monolift]

I'll give that a try.

I'm not a huge fan of the whole thing either, but my client really wants this to work.

[dingman]

Try pointing out to them that any available solution lets joe random log in as them, and do anything they could do. Presumably this includes lots of options they wouldn't want excercised, since the airline doesn't seem to intend this to be used by any old surfer. For that matter, check over their TOS with the airline - my guess would be that the airline requires them to safeguard their username and password. Handing it out to anyone with a web browser hardly does that.