You don't need it to submit to different scripts, or even make it
javascript dependent, just create an intermittent script that makes the decisions for you, or, include different files based on the submit. Example,
<form action="page1.php" method="post">
<select name="show-me" id="show-me">
<option value="">Select</option>
<option value="red">Red</option>
<option value="green">Green</option>
<option value="blue">Blue</option>
</select>
<input type="submit" value="submit">
</form>
Then in page1.php,
$possible_values = array(
'red' => 'red.php',
'green' => 'green.php',
'blue' => 'blue.php'
);
if (isset($_POST['show-me']) and array_key_exists($_POST['show-me'],$possible_values)) {
include($possible_values[$_POST['show-me']);
}
else {
echo "<p>Invalid input! Please use form below.</p>";
// re-output form here!
exit;
}
A couple things about this approach:
- It is (pretty close to?) impossible to hack because it adheres to the basic premise of security:
accept only what you want, throw everything else away. Any values submitted except red, blue, or green for show-me are rejected.
- one might say why don't you do this?
$include_file = $_POST['show-me'] . '.php';
include($include_file);
This
does open the file to injection of malicious data. I could post anything I want to your script and maybe include something I shouldn't see.
- Now you can use Javascript for what it's intended (in this case:) assisting the user in using the form properly.
...
<head>
<script type="text/javascript">
window.onload=function() { attachBehaviors(); };
//
function attachBehaviors() {
var obj=document.getElementById('my-form');
if (obj) {
obj.onsubmit=function() {
if (document.getElementById('show-me').selectedIndex==0) {
alert('Please select an option.)';
return false;
}
return true;
};
}
}
</script>
</head>
<body>
<form action="page1.php"
id="my-form" method="post">
<select name="show-me" id="show-me">
<option value="">Select</option>
<option value="red">Red</option>
<option value="green">Green</option>
<option value="blue">Blue</option>
</select>
<input type="submit" value="submit">
</form>
....
If you feel you must submit to different scripts, then use the same logic to print a header and carry all the submitted values. That seems like more work though with redundant data . . . same headers/template, duplication of a lot of programming . . .
