0

I understand that with a form submittion you can only use the method POST or GET, not both at the same time.

But I am trying to make a forum script so when you reply to a topic, it will query that to the database and give it the reply_id depending on what the $_GET['id'] was when you submit the reply. The only problem is when I press submit to POST the data with the POST method, I can't carry along the $_GET to the next page after it submits. So I cant query the $_GET['id'].

Now, I thought why not make the action "topic.php?id=" but that didn't work for some reason.

The thing thats wrong is that when I press submit on the form, it won't even query anything. :/

Anyone got any idea whats wrong with the code?

Form:

<form action="topic.php?id=$postid" method="POST">
    <textarea name="comment" class="field span6" rows="3" placeholder="Content..."></textarea><br /><br />
    <input type="hidden" name="id" value="<?php echo $_GET['id'];?>">
  <div><input type="submit" name="submit" value="Reply" /></div>
</form>

Form Action:

  if(isset($_POST['submit'])) {
  $postid=$_POST['id'];
  $errors = array();
    if(isset($_POST['comment'])){
      if(empty($_POST['comment'])){
        $errors[] = 'Error, try again!';
      }

      if(strlen($_POST['comment']) > 400){
        $errors[] = 'Comment must be in a 10 to 400 characters range!';
      }

      if(empty($errors)){
        //write to topics and replies tables
        $q2 = @mysql_query("INSERT INTO reply VALUES('$postid', \"$comment\", now(), '$id')");
      } else {
        echo 'You have '. (count($errors) + 1).' errors in your form:<br />';
        foreach($errors as $error){
          echo $error .'<br />';
        }
        echo '<a href="new_topic.php">Try again</a>';
      }
    }
11
  • I used to use both at same time, you find everything in $_REQUEST
    – Gar
    Oct 12, 2013 at 8:47
  • btw your code is vulnerable to sql injection Oct 12, 2013 at 8:47
  • I'm not a PHP expert but, aren't you supposed to add a semi-column after the echo in "topic.php?id=<?php echo urlencode($postid) ?>"
    – Johnaudi
    Oct 12, 2013 at 8:47
  • It really doesn't matter whether you do or don't as its the only element in that php snippet. And obviously, I'm not finished with the code, its just to make sure it works. Oct 12, 2013 at 8:48
  • Your missing a semi colon after your echo (<?php echo urlencode($postid) ?>); Probably because of a php error the form is not going to submit at all. Just out of curiosity why do you want to pass this value as a GET variable. Why do you not just pass it as a hidden value in your form. Oct 12, 2013 at 8:49

4 Answers 4

1

try to use a hidden field in form so that you can store the id in the hidden field or else you can store it in sessions

 <input type="hidden" name="id" value="<?php echo  urlencode($postid); ?>" />

and

$_REQUEST['id']; in form action

1

One way to do this easily is using a hidden field. So use

<input type="hidden" name="id" value="<?php echo GET['id'];?>">

Then on the action page you should be able to use

 $postid=$_POST['id'];

Alternatively if I have the wrong end of the stick use this on the form instead

<input type="hidden" name="id" value="<?php echo $postid;?>">

Also change the form action to action="topic.php".

How the updated code should look

<form action="topic.php" method="POST">
      <textarea name="comment" class="field span6" rows="3" placeholder="Content..."></textarea><br /><br />
      <input type="hidden" name="id" value="<?php echo $postid;?>">
      <div>
           <input type="submit" name="submit" value="Reply" />
      </div>
</form>
2
  • I updated mine with that code but it still doesn't submit a query for some reason. Oct 12, 2013 at 8:58
  • @KevinHarrison I have put the full form code into my answer. Please also try using print_r($_POST); on the topic.php page a the top to ensure you are receiving the post data correctly then let me know and i will update further Oct 12, 2013 at 9:08
0

You can use $_REQUEST to get the values from both $_POST and $_GET or very simply use hidden input field in your form to send the id, something like

<input type='hidden' name='id' value='<?php echo $postid' />

This can be a better way to send the id.

1
  • I tried that but it doesn't query anything. I'm going to update my post with new code and tell me if you see an issue? Oct 12, 2013 at 8:56
0

2 things to think about here. Pass any variables from previous pages that you need in hidden form fields as others have said above. Also, stop using $_GET and $_POST directly, you need to validate the input so use a generic function to do so, which will also give you the benefit of just being able to ask for the var without having to worry about it being in either $_GET or $_POST. Something along these lines:

/**
* returns the contents of the GET or POST variable
* favours POST over GET
*/
function GP($var,$trusted=false)
{
    $op=$_GET[$var];
    if(isset($_POST[$var]))
    {
        $op=$_POST[$var];
    }
    if(is_string($op))
    {
        $op=trim(urldecode($op));
        if(!$trusted){
            $op=htmlspecialchars($op,ENT_QUOTES);
        }
        // $op=addslashes($op);
    }
    return $op;
}

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.