is this wrong information or am i wrong

looks impossibe unless, off course, ive overlooked something...

[kumarsena]

i know this is against the TOS probably, but this is site got a sort of a tutorial on making a contact form...now what i dont get is this: there seems to be two files, forms and php script. how is the forms data passed to the script. i dont get it....

k

[edited by: jatar_k at 3:06 am (utc) on Oct. 14, 2004]
[edit reason] removed url [/edit]

[dreamcatcher]

Hi kumarsena,

You pass the form data to the PHP file in your form action.

<form method="POST" action="whatever.php">

Your HTML data would be passed to the 'whatever.php' file, where you would process it. Or did you mean something else?

[kumarsena]

well,

what i meant was, in the senmail script on that site, i odnt see the global varibales being 'collected'

although the formdata is passed, this doesnt automatically result in variables set up with the names of the form elements, right?

[kumarsena]

what im trying to say is that there is no

$visitormail = $_POST['visitormail'];

in the script...

[kumarsena]

or it could simlpley be that im too tired rite now...

[dreamcatcher]

ah..the links gone now. Maybe this script is set up on a site that has register globals on? In which case the superglobals aren`t necessary and just $visitormail will work.

[mincklerstraat]

This is probably a somewhat old tutorial, or else a rather non-security conscious one. PHP used to be configured so 'register globals' was 'on', meaning that $_POST['whatever'] would come through as $whatever without doing anything at all. This has some big security problems unless you're very, very particular about how you write your code - so even if your server has register globals 'on', it's best to write code using $_POST['whatever'] - your code will be more 'portable' too, meaning you will be able to use it on more different server environments if you do so. PHP has, for a couple of years now, been released with 'register globals' off by default, but most hosts still turn it on so old scripts work ok. You can turn it off with an htaccess file. I do this.