PHP - Step By Step Form With Hidden?

Hey guys,

I have checked in google and on this forum for answers to my question but haven't found anything regarding validating each step of a multipage form, hence my post!

I wonder if anyone can help me, or rather provide me with advice....

I am trying to create a multipage form, which so far i have done a basic one which i have done using my php cookbook by O'Reilly which is a very basic version, without any validations or anything....

My multipage has 3 steps:
Step1: user details - takes users name, email etc Step 2: House details - Takes users address, house type, no of rooms, descriptions of rooms etc Step 3: Image upload - Allows user to upload 3 images max to display (using my original file upload script)
As i said, my basic multipage form works, storing all posted values into sessions which can then be outputted at the end in a review page, which will be at the end of the form.

In previous forms i have created, i always have an html form, which when posted or submitted, has an action of a separate php script which processes the form and validates it, sends email, updates database etc, and all errors are then stored in sessions and appear back on the form page until there are no errors displayed and then a success page is shown....

so the code i have taken from my cookbook doesn't seem to be able to allow me to validate EACH STEP of the form? it can validate at the end, when the user reviews and then the form is processed all in one go. But i want to be able to validate form entries at each step, rather than in one go.
For example if a user leaves their 'town' field empty, an error message will be displayed before going to the next step...

If you see the code i have done so fare below:
Code: [Select]
<?php
                //Figure out what stage to use
                if (($_SERVER['REQUEST_METHOD'] == 'GET') || (! isset($_POST['stage'])))
                {
                    $stage = 1;
                }
                else
                {
                    $stage = (int) $_POST['stage'];
                }
                
                //Save any submitted data
                if ($stage > 1)
                {
                    foreach ($_POST as $key => $value)
                    {
                        $_SESSION[$key] = $value;
                    }
                }
                
                if ($stage ==1)
                {?>
                <div id="submitCustomerForm">
<FORM ACTION='<?php echo $_SERVER['SCRIPT_NAME'] ?>' method='post'>
                    <h7>Your details</h7>
                        <br />
                    <div id="inputfield">
                    <label class="textleft" for="forename">forename:</label>
                            <input class="fade" name="forename" type=text size="30" align="right" maxlength="15" id="forename" value="<?php echo $_SESSION['forename']?>">
                    </div>
                        <div id="inputfield">
                    <label class="textleft" for="surname">surname:</label>
                    <input class="fade" name="surname" type=text size="30" maxlength="15" id="surname" align="right" value="<?php echo $_SESSION['surname']?>">
                    </div>
                    <div id="inputfield">
                    <label class="textleft" for="email">email:</label>
                    <input class="fade" name="email" type=text size="30" maxlength="30" align="right" id="email" value="<?php echo $_SESSION['email']?>">
                    </div>
                        <br />
                        <h7>Your property Address</h7>
                        <br />
                    <div id="inputfield">
                        <label class="textleft" for="address1">Address Line 1:</label>
                        <input class="fade" name="address1" type=text size="30" maxlength="30" id="address1" value="<?php echo $_SESSION['address1'];?>" />
                        </div>
                        <div id="inputfield">
                        <label class="textleft" for="address2">Address Line 2:</label>
                        <input class="fade" name="address2" type=text size="30" maxlength="30" id="address2" value="<?php echo $_SESSION['address2'];?>" />
</div>
                        <div id="inputfield">
                            <label class="textleft" for="town">Town/City:</label>
                            <input class="fade" name="town" type=text size="30" maxlength="30" id="town" value="<?php echo $_SESSION['town'];?>" />
                        </div>
                        <div id="inputfield">
                            <label class="textleft" for="county">County:</label>
                            <input class="fade" name="county" type=text size="30" maxlength="30" id="county" value="<?php echo $_SESSION['county'];?>" />
                        </div>
                        <div id="inputfield">
                            <label class="textleft" for="postcode">Post Code:<span class="asterix">*</span></label>
                            <input class="fade" name="postcode" type=text size="30" maxlength="30" id="postcode" value="<?php echo $_SESSION['postcode'];?>" />
                    </div>
                        <input type='hidden' name='stage' value='<?php echo $stage + 1 ?>'/>
                        <input name="Next" class="submit" type="image" align ="right" src="Images/updateButton.png" />
                    </FORM>
                </div>
               
                <?php } else if ($stage == 2) { ?>
                <div id="submitCustomerForm">
                <FORM ENCTYPE="multipart/form-data" action="<?php echo $_SERVER['SCRIPT_NAME']?>" method="post">
                <input type="hidden" name="MAX_FILE_SIZE" value="1000000" />
                        <div id="divinputfile">
                            <input name="userfile" type="file" size="30" id="userfile" onchange="document.getElementById('fakeuserfile').value = this.value;"/>
                            <div id="fakeinputfile"><input name="fakeuserfile" type="text" id="fakeuserfile" /></div>
                       </div>
                    <br />
                        <input type='hidden' name='stage' value='<?php echo $stage + 1 ?>'/>
<input type="image" src="Images/upload.png" align="right" name="Send File" />
                    <br />
                    <br />
                 </FORM>
                </div>
               
                <?php } else if ($stage == 3) {?>
                <p class="largeblue">
                hello there <?php echo $_SESSION['forename']; echo $_SESSION['surname'];?>
                    <br />
                    the first line of your address is: <?php echo $_SESSION['address1'];?>
                    <br />
                    the second line of your address is: <?php echo $_SESSION['address2'];?>
                </p>
                <?php } ?>
For the 'form action' it uses Quote

<?php echo $_SERVER['SCRIPT_NAME'] ?>

meaning that the form reloads the page, upon which the stage number has changed and therefore loads next step.
Where as normally, i have the path for my process script which would handle validation etc and then send them to a success screen or back to the form displaying errors.

I propose a few ideas that i could do to get around this, which i just wanted to get a bit of insight on, as to which way of going about this is the right one!!

My first idea would be to treat each step of the form as a separate form almost. Doing a form as i normally do, where the form is on one page, then the completed form is sent to a processing page, which processes the entries, sends user back to  the form page with errors if there are any, or if it is all ok, increase the 'stage number' in a session and then use a header to go to next page(the next step of the form. at the top of each page is a check to whether the stage number is the same as the step number of the form.

OR would i put all my validation in one page, with all the steps of the form as i have at the moment?

OR is there a way to send each step of the form to a process script, which then sends the user back to the original form displaying errors if there are any or then moves them to the next step??

Just a little confused with which method to do this, i dont want to start working on it and find out i have done it completely the wrong way!!

any help would be greatly received, thanks guys!!

Craig

Hi all,

I've been trying to create a page whereby a user enters a few details which is then emailed, but I'm seriously stuck on one issue.

First page - console type
Second page - serial number

Only two steps at the moment as I need to figure it out.  I'm passing everything into a variable from a post(ed) form.  It appears on the next page fine, as I've been testing, but the details entered on the first page don't show on the third, however, the details from the second page do!  Here is the code I have:

Code: [Select]
   <?php switch ($step) { 
   case "1": ?>
   <table width="75%" align="center">
   <tr>
   <td colspan="2" valign="top">
   <form action="?step=2" method="post" id="consoletype">Please select your console type<br /></td></tr>
   <tr><td align="center" valign="top" width="50%">
<label>Xbox 360 Original (Beige or Black)<br /><img src="images/xbox360orig.gif" width="250" height="250"><br /><input class="button" type="radio" name="console" value="xboxorig" /></label></td>
<td align="center" valign="top" width="50%"><label>Xbox 360 Slim<br /><img src="images/xbox360slim.gif" width="250" height="250"><br /><input type="radio" name="console" value="xboxslim" /></label></td>
    </tr>
    <tr>
    <td colspan="2">
   <input type="submit" value="Next">
   </form>
   </td>
   </tr>
   </table>
   <?php echo $code; 
   include("footer.php");
   echo $code2;
   include("compat.php");
   echo $code3;   
   case "2":
   $console = $_POST['console'];
   echo $console; ?>
   Please enter your Xbox 360 Serial Number:<br />
   <form action="?step=3" method="post">
   <input name="serialno" type="text" size="20" maxlength="20">
   <input type="submit" value="Next">
   </form>
   <?php echo $code; 
   include("footer.php");
   echo $code2;
   include("compat.php");
   echo $code3;
   case "3":
   echo "<br />";
   $serialno = $_POST['serialno'];
   echo $serialno;
   echo $console;
   echo $code; 
include("footer.php");
echo $code2;
include("compat.php");
echo $code3; } ?>
I do understand it's messy at the moment but I don't see much point beautifying everything until I can solve this problem!

Cheers!

I'm stuck at trying to figure out out to complete the 3 Step scripts to accomplish passing $variables between 2 different servers.  Since there will actually be 12 Non-POST $variables involved in the SERVER #1 to SERVER #2 transfer , it doesn't appear that trying to put these all in a URL string and going the 'GET' route is practical.    I'm just using 3 short test variables in the examples.  My eyeballs started rolling within I ran across something about 'CURL' that might be a necessary part of the solution?   The code I have been able to hammer out so far is below as STEP 1, STEP 2 and STEP 3.    STEP 1

<?php

// submit.php 

// STEP 1

// On (LOCAL) SERVER #1 TO relay $variables to 'process.php' on (REMOTE) SERVER #2

// To submit $variables to directly another destination server script
// NOTE: The $variable are NOT the result of Form Input !!!

// For login Authenticaion ALL 3 must match db entries on SERVER #2 
// NOTE: (Again) The $variables are NOT the result of Form Input !!! 

$userid = "adam";
$passwd = "eve";
$pscode = "peterpan";

// NOTE: (Again) The $variable are NOT the result of Form Input !!! 
// These $variables are needed for MySQL db INSERT on the destination URL server
// For testing simplicity (actual data will be 12 $variables)

$a = "apple";
$b = "banana";
$u = "1234567;

//
// Not sure if something called 'CURL' is needed here ???
//

$submit_to_url = http://www.blahblah.com/process.php";

?>

STEP 2

<?php

// processor.php

// STEP 2

// ON SERVER #2 TO RECEIVE DATA DIRECTLY FROM SERVER #1 'submit.php'

// To receive and process the $variables into a MySQL db on SERVER #2
// NOTE: The $variables are NOT the result of Form Input !!!

// First validate $userid, $passwd & $pscode against `verify` table MySQL records

require '/SERVER_2_securelocation_for_database_connection/secret_mysqli.php';

if (mysqli_connect_errno()) {
  echo "Failed to connect to MySQL: " . mysqli_connect_error();
}

//
// Not sure if something called 'CURL' is needed here ???
//

// These login $variables are from submit.php on SERVER #1

$userid 
$passwd 
$pscode

$sql="SELECT `userid`, `passwd`, `pscode` FROM `verify` 
WHERE `userid` = '$userid'" AND `passwd` = '$passwd` AND `pscode` = '$pscode';

$result = mysqli_query($con,$sql);

if (!mysqli_query($con,$sql)) {
  die('Error: ' . mysqli_error($con));
}

//
// Then some Authentication code if ALL 3 components match
//

// If Authentication = true then $passed = "YES" must sent
// be sent back to the 'finalstep.php' script on SERVER #1
// If Authentication (or connection) = false ... $passed = "NO" 

$return_to_url = http://www.blahblah.com/finalstep.php";

// These $variables are from submit.php on SERVER #1

$a = "apple";
$b = "banana";
$u = "1234567";

$sql="INSERT INTO `data` (`a`, `b`, `u`) 
VALUES ('$a', '$b', '$u')"; 

if (!mysqli_query($con,$sql)) {
  die('Error: ' . mysqli_error($con));
}

// If $SQL INSERT into `data` on SERVER #2 works ...
// $status = "Pending" must be sent back to the 'finalstep.php' 
// script on SERVER #1 for MySQL db Table insertion
// If $SQL INSERT into `data` = false, then $status = "Error"
// NOTE: The '$u' $variable also needs send back to finalstep.php !!!

$return_to_url = http://www.blahblah.com/finalstep.php";

mysqli_close($con);

?>

STEP 3

<?php

// finalstep.php 

// STEP 3

// ON SERVER #1 TO RECEIVE DATA DIRECTLY BACK FROM SERVER #2 process.php

// To receive the $passed, $status and $u $variables for final step action
// NOTE: The $variable are NOT the result of Form Input !!!

require '/SERVER_1_securelocation_for_database_connection/secret_mysqli.php';

if (mysqli_connect_errno()) {
  echo "Failed to connect to MySQL: " . mysqli_connect_error();
}

// These $variables are from process.php on SERVER #2

$passed
$status
$u

$sql="UPDATE `tracking` 
SET `passed` = '$passed',
    `status` = '$status' 
WHERE `uniqueid` = '$u' ";

$result = mysqli_query($con,$sql);

if (!mysqli_query($con,$sql)) {
  die('Error: ' . mysqli_error($con));
}

mysqli_close($con);

?>

Thanks very much for any assistance and guidance.   -freakingOUT  

I can add and delete data from my table. Now I need to be able to change one or more fields in an entry. So I want to retrieve a row from the db, display that data on a form where the user can change any field and then pass the changed data to an update.php program.

I know how to go from form to php. But how do I pass the data from retrieve.php to a form so it will display? Do I use a URL and Get? Can I put the retrieve and form in the same program?

This is just a snippet of my code. The php script itself is called test.php and so it calls itself once the form is submitted. I keep having problems retrieving the data back correctly; I am testing in retrieving the data on the same script from the same page before retrieving the POST data from another webpage.

If $decimalSum is a variable that assigns a value that is hard-coded then I would be able to retrieve the same value. However, if the value is computed I can not retrieve it unless I click on the "Find" button twice. This is such a strange behavior and I don't know why.

Does anyone have any suggested solutions to this?



<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
  "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>
  <meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
  <title></title>
</head>
<body>

<?php
echo '<form enctype="multipart/form-data" method="post" action="test.php">';

echo '   <label for="_firstName">First name :     </label>';
echo '   <input type="text" id="_firstName" name ="_firstName">';
echo '   <input type="checkbox" value="1" name="_firstNameChecked"/>';  

echo '   <label for="_middleName">Middle name :     </label>';
echo '   <input type="text" id="_middleName" name ="_middleName">';
echo '   <input type="checkbox" value="1" name="_middleNameChecked" />';
   
echo '   <label for="_lastName">Last name :     </label>';
echo '   <input type="text" id="_lastName" name ="_lastName">';
echo '   <input type="checkbox" value="1" name="_lastNameChecked" />';

echo '<br />';

echo '<input type="submit" name="Find" value="Find" />';

$firstNameChecked        = intval(($_POST['_firstNameChecked']));
$middleNameChecked    = intval(($_POST['_middleNameChecked']));
$lastNameChecked         = intval(($_POST['_lastNameChecked']));

$decimalSum = (int)((2*2*2)*$firstNameChecked + (2*2)*$middleNameChecked + (2*1)*$lastNameChecked);

//$decimalSum = 28;

echo '<br />';
echo '$decimalSum = ' . $decimalSum . '<br />';

echo '<input type="hidden" name="_decimalSum" value = "' . $decimalSum . '" />';

$decimalSum2      =     ($_POST['_decimalSum']);

echo '$decimalSum2  = ' . $decimalSum2 . '<br />';
   
echo '</form>';
echo '</body>';
echo '</html>';
?>

I have created a form which allows people to add data to a database.  However, I want to replicate the form across several pages and give each page a category.

For example, if I have a website based on sport.  I have a page which enters information into the baseball category, a page which enters information into the ice hockey category, a page which enters information into the soccer category etc.

Can someone advise how I would do this?

Is there anything wrong (or insecure) with using hidden form fields?

I am working on a page where the user can choose one of 4 different subscription options.

The approach I was going to use is to have a separate form for each plan, and when the user chooses one, submit a hidden form value so my script knows which subscription plan to grab out of the database.

Thoughts?

Hey all, i have a little problem.

I have a form, and when submitting, i need to use the ID that i put in the $_GET array earlier.

When you're entering my site, and clicks a certain link, the $_GET will store show=1, and when you're submitting the form on the page, the value of 'show' is needed on the redirect page.. I thought that it would be smart to transfer it with a hidden textfield, but somehow it fails?

<form id="comment-form" action="comment_profile.php" method="POST">
                                    <fieldset>
                                        <div class="field">
                                            <textarea name="comment-field" rows="2" cols="66"></textarea>
                                            <input type="hidden" name="pofileid-field" value="<?php echo $_GET['show']; ?>" /> // <--- Here is the hidden field.
                                            <input type="submit" name="submit-field" class="submit" value=""/><i> (HTML tags kan bruges)</i>
                                        </div>
                                    </fieldset>
                                </form>

Above you can see a piece of my code, and i marked the hidden field aswell.
What i do not understand is, why isn't the hidden fields value return the value of show when i check in comment_profile.php, as that is where it returns?

Thanks in advance
-Niixie

Hi
I've got a form that users enter an identification pin in for their first question  as well as clicking a radio button(Q1.php) . They click submit and the answers are put through a couple of multiplication function and then placed in a table (alongside the pin)  via Q2.php.

 On the Q2 page I want to place the 2nd question that the user needs to answer. 

Rather than making them retype the pin I was hoping to process it as a hidden field - being picked up from their Q1.php entry.
This 'hidden pin echo ' process will continue throughout Q2- Q10 pages.

However - I can't seem to include any php in the page after the Q1 form has been processed.  Have I got my php tags messed up?

<?php
$con = mysql_connect("localhost","ca","d");
if (!$con)
  {
  die('Could not connect: ' . mysql_error());
  }
mysql_select_db("candango", $con);

$q1 =$_POST['q1'];
$pin =$_POST['pin'];


$ans1 = $q1 * 3;
$ans2 = $q1 * 5;
$ans3 = $q1 * 2;


$enter_sql= "INSERT INTO aapcm2 (pin,ans1, ans2, ans3)
VALUES ('$pin','$ans1','$ans2','$ans3')";
$enter_query =mysql_query($enter_sql) or die (mysql_error());
?>

<body>

<p>Thank you - You have successfully entered your answers.</p><form action="q2.php" method="post">
  <p>What do you think the answer to this one is? 
    <input type="radio" name="q2" id="q2" value="-3">
    <label for="q2"></label>
  <input name="Hidden" type="hidden" id="Hidden" value="$pin" /></p>
  <p>
    <input type="submit" name="button" id="button" value="Submit">
  </p>
</form>

<p></p>
</body>

Here's my PHP form code:

Code: [Select]
<form method='POST' action="<?php basename($_SERVER['PHP_SELF']);?>" onSubmit="return stripInputBoxes(1)">
<?php
echo "<div id = 'purchaseOrderRow1' style = 'display:none;border: 1px solid black;'>";
echo $integrityBuildingProductsPDF;
echo '<input type = "hidden" id = "pdf1" value = "" name = "pdf1" />';
echo '<button name = "savePurchaseOrder" type = "submit">Save Purchase Order</button>';
echo "</div>";
?>


</form>
Here's my Javascript:
Code: [Select]
function stripInputBoxes(pdfNumber)
{
if (!document.getElementsByTagName) return;

for (i = 0; i < document.getElementById('tableBody').getElementsByTagName('tr').length - 3; i++)
{
document.getElementById(i).parentNode.innerHTML = document.getElementById(i).value;
}

document.getElementById("pdf" + pdfNumber).value = "ljkasdkljf";

return true;
}
Will this set the value of the hidden variable? I'm trying to echo the value of $_POST['pdf1'] but it comes out to nothing when the page reloads. How do I do this?
What I'm trying to do here is display a purchase order on the screen and the user can edit the quantities in the purchase order. They click SAVE to save the new updated quantities and it auto generates a PDF that's saved on the server with those new quantities. The problem is I need to run the stripInputBoxes function to take the <input> tags out of the HTML code before creating the PDF because the PDF generator doesn't recognize the tags.

If I store a value in a hidden form control, and then use that as a means to pass the value to another PHP script, could that cause any security issues?

 

 

Can someone please tell me what I am doing wrong here?  For some reason, the variable doess not seem to be getting passed to the "action" php script

this input is in my html form (action=post)...



<input type="hidden" name="httpreferer" value="<?php echo $_SERVER['HTTP_REFERER'] ?>" />




this is in the action script...

$httpreferer=$_POST['httpreferer'];
echo $httpreferer;

Code: [Select]
            <td >
           
               
               
               
               
                    <form action="" method="post">
                   
                    <b> <?php echo $likes_count; ?> </b> <b> | </b> <b> <?php echo $dislikes_count; ?> </b>
                   
                    <button class="LikeButton" type="submit" name="likes" value="+1">Likes</button>
                    <button class="DislikeButton" type="submit" name="dislikes" value="-1">Dislikes</button>
                   
                   
                   
                   
                    <input type="hidden" name="hidden_con_id" value="<?php echo $con_id; ?>" />
                </form>
         
               
               
            <?php echo $con_id; ?>
               
               
               
           
            </td>
I have a table with a voting system and the problem I am experiencing is that the hidden id, which I call the hidden contribution id is not set thus the numeric array changes. I know that it is not best practice to use a numeric array for this, though I learned that afterwards.

This is the array:

Code: [Select]
                // POST BUTTONS inside the table
                if (isset($_POST['likes'])) {
                    $likes = $_POST['likes'];
                }
                if (isset($_POST['dislikes'])) {
                    $dislikes = $_POST['dislikes'];
                }
                if (isset($_POST['likes']) || isset($_POST['dislikes'])) {
                    $hidden_con_id = $_POST['hidden_con_id'];
                }

               
               
// $array = array ($likes, $dislikes, $con_id, $user_id);
               
                if (isset($likes)) {
                    $array[] = $likes;
                }
                if (isset($dislikes)) {
                    $array[] = $dislikes;
                }
                if (isset($hidden_con_id)) {
                    $array[] = $hidden_con_id;
                }
                if (isset($dnuser_id)) {
                    $array[] = $dnuser_id;
                }
As said the problem I have is that the hidden_con_id variable is not set and that consequently array[2] becomes the user_id variable.


Any suggestions why it is not becoming set?

hi , when I use hidden input tag and save there information to send with the form , is that secure?
I mean , if the user or hacker or anything can change the value of the hidden tag?
thanks , Mor.