PHP - Banning/redirect After Submission!

I'm trying to put together a script that redirects visitors based on their IP, user agent and/or referral url. Basically I want the script to scan these three factors from the visitor, if any of them turn out to match my redirect-requirement it redirects the user. I know the code is horribly coded, I'm incredibly new to the php-scene and consider myself a complete noob. As you can see I want redirected visitors to go to google.com and un-redirected to msn.com(examples). Really thankful for all the help I can get! Right now nothing works, any suggestions?

<?php
 
function redirect($page) {
        Header( "HTTP/1.1 301 Moved Permanently" );
        header('Location: ' . $page);
        exit;
}
 
$referrals=array('pitchingit.org','referral2');
$badAgents = array("useragent1", "useragent2");
$deny = array("78.105.191..*","100.101.103..*");
 
if (in_array($_SERVER['HTTP_REFERER'], $referrals, FALSE)) 
{
        header("Location: http://www.google.com");
} 
else 
{
        header("Location: http://www.msn.com");
}  
 
if(in_array($_SERVER['HTTP_USER_AGENT'],$badAgents)) 
{
        redirect("http://www.google.com/");
        exit();
} 
 
$add=$_SERVER['REMOTE_ADDR'];
foreach ($deny as $ip) {
        if (preg_match("^.$add.*^",$ip)) {
        redirect("http://www.google.com");
        }
}
 
redirect("http://www.msn.com");
 
?>

I'm trying to figure out where my problem is. Its not submitting my form. I'm getting the alert but when it submits it does the url?variables=whatever deal.

Code: [Select]
<?php require ('php/eventnames.php'); ?>
   
<script type="text/javascript" src="forms/addnew/js/eventnames.js"></script>

<!-- Form -->
<form action="#" id="eventNameForm" >
    <fieldset>
    <legend>Add New Event Name</legend>
            <div class="field required">
        <label for="eventName">Event Name</label>
        <input type="text" class="text" name="eventName" id="eventName" title="Event Name"/>
        <span class="required-icon tooltip" title="Required field - This field is required, it cannot be blank, and must contain something that is different from emptyness in order to be filled in. ">Required</span>
        </div>
            <div class="field required">
        <label for="shortName">Event Short Name</label>
        <input type="text" class="text" name="shortName" id="shortName" title="Event Short Name"/>
        <span class="required-icon tooltip" title="Required field - This field is required, it cannot be blank, and must contain something that is different from emptyness in order to be filled in. ">Required</span>
        </div>
            <div class="field required">
        <label for="eventType">Event Type</label>
                <select class="dropdown" name="eventType" id="eventType" title="Event Type">
                    <option value="">- Select -</option>
                    <?php
                        $eventTypes = array('Singular', 'Recurring', 'Pay Per View');
                        foreach($eventTypes as $et):
                    ?>       
                        <option value="<?php echo $et; ?>"><?php echo $et; ?></option>
                    <?php endforeach; ?>
                </select>
        <span class="required-icon tooltip" title="Required field - This field is required, it cannot be blank, and must contain something that is different from emptyness in order to be filled in. ">Required</span>
        </div>
            <input type="hidden" name="userID" id="userID" value="<?php echo $userID; ?>" />     
            <input type="submit" class="submit" name="submitEventName" id="submitEventName" title="Submit Event Name" value="Submit Event Name"/>
</fieldset>
</form>
<!-- /Form -->

<!-- Messages -->
<div class="message message-error">
    <h6>Required field missing</h6>
    <p>Please fill in all required fields. </p>
</div>
<div class="message message-success">
    <h6>Operation succesful</h6>
    <p>Content Page was added to the database.</p>
</div>
Code: [Select]
$(document).ready(function() {
     $('div.message-error').hide();
     $('div.message-success').hide();
     alert("Test Alert!");
     ("#eventNameForm").validate({
         rules: {
             eventName: {
                 required: true
             },
             shortName: {
                 required: true
             },
             eventType: {
                 required: true,
                 rangelength: [1]
             }
         },
         messages: {
             eventName: "Please enter the event name!",
             shortName: "Please enter the event's short name!",
             eventType: "Please enter the event type!"
         },
         submitHandler: function(form) {
             var userID = $("input#userID").val();
             var eventName = $("input#eventName").val();
             var shortName = $("input#shortName").val();
             var eventType = $("select#eventType").val();
             var dataString = 'userID=' + userID + '&eventName=' + eventName + '&shortName=' + shortName + '&eventType=' + eventType + '&submitEventName=True';
             $.ajax({
                 type: "POST",
                 url: "processes/eventnames.php",
                 data: dataString,
                 success: function(myNewVar) {
                     if (myNewVar == 'good') {
                         $('div.message-error').hide();
                         $("div.message-success").html("<h6>Operation successful</h6><p>" + eventName + " Page saved successfully.</p>");
                         $("div.message-success").show().delay(10000).hide("slow");
                         $(':input','#eventNameForm')
                         .not(':submit, :hidden')
                         .val('');
                     } else if (myNewVar == 'bad1') {
                         $('div.message-success').hide();
                         $("div.message-error").html("<h6>Operation unsuccessful</h6><p>" + eventName + " already exists in the database.</p>");
                         $("div.message-error").show();   
                     } else if (myNewVar == 'bad2') {
                         $('div.message-success').hide();
                         $("div.message-error").html("<h6>Operation unsuccessful</h6><p>" + shortName + " already exists in the database.</p>");
                         $("div.message-error").show();     
                     } else if (myNewVar == 'bad3') {
                         $('div.message-success').hide();
                         $("div.message-error").html("<h6>Operation unsuccessful</h6><p>" + eventName + " and " + shortName + " already exists in the database.</p>");
                         $("div.message-error").show();     
                     }
                 }
             });
             return false;
         }   
     });
});

Hello,

I like to send and reading variable with post and get. Is it possible?

I have do that but that doesn't work
Code: [Select]
<form id="test" action="test.php" method="post">
<input type="hidden" name="a_recup" value="variable_ici"/>
</form>
<a href='test.php?town=Montreal' onclick='document.getElementById("test").submit()'>link</a>
<a href='test.php?town=New_York' onclick='document.getElementById("test").submit()'>Link1</a>
<?php
 
$variable=$_POST['a_recup'];
 
echo $variable;
 
$ville=$_GET['town'];
echo $town;
 
?>

Thanks for your help

Where should my Form go once it is submitted?

I am reading through some old code, and I was using some pretty convoluted programming to get everything (e.g. error and success messages after form submittal) to work.

Basically what I would do was...
Code: [Select]
HTML to Open Page
PHP to Handle Form
If Data Okay...
Success Message (e.g. "Your account was created!")
HTML to close out Page
If Data Invalid...
Failure Message (e.g. "A System Error occurred.  Please contact the Administrator.")
HTML to close out Page
HTML Form
HTML to Close Page
I have heard that you should always put your PHP first in the script and then follow it up with your HTML Page and Form.

But where should you go once the form is submitted?


My second attempt at things - to fix the mess above - was to REDIRECT the user to a "Handling Page" which basically was a large case statement that would read a "processing code" and display the right message.

But that seems kind of hokey too?!   

Can someone help me come up with a more professional and scalable solution??

Thanks,


Debbie

Hello there,

I have made a ban form on my website. It is all going good until I open phpmyadmin. There is two records from one submission. Usually the second record has some missing information. There should not be a duplicate and I do not understand why it is happening. If anybody could explain what is causing this would be great.

Here is the page.

<?php
session_start();
require_once 'database.php';
if(isset($_SESSION['mod']))
 {
     $userid = $_SESSION['user'];
     if(isset($_GET['action']) && strcasecmp($_GET['action'], "file") == 0) // checks to see if form is submitted
     { 
         $username = $_POST['user'];
         $time = $_POST['time'];
         $reason = $_POST['reason'];
         $u_time = date("U");
         $r_time = date("m-j-Y g:i A");
         if($time == "00")
         { // if the time is a permaban
             $sql=mysql_query("SELECT * FROM user WHERE username='$username'") or die("Error 1");
             $data=mysql_query($sql);
             $user_ip = $data['last_ip'];
            if ($user_ip != 127.0.01)
             { // admin stuff ;)
                 $p_ban=mysql_query("INSERT INTO ip_ban (ip,real_time,unix_time,days_left,reason) VALUES ('$user_ip','$r_time','$u_time','99999999999','$reason')") or die("Error 2");
                 echo 'The user '.$username.' has been banned.'; 
             }else{ // if it is an admin
            echo 'You cannot ban that user.';
             }
         }else{ // not a perma ban
         if($username != "admin") // admin stuff
         {
             $temp_ban=mysql_query("INSERT INTO blacklist (email,reason,end_date,appeal,unixtime) VALUES ('$username','$reason','$time','No','$u_time')") or die("Error 3");
             echo 'The user '.$username.' has been banned.';
         }else{
         echo 'You cannot ban that user.';
         }
         }
     }else{
     $user_ban = $_GET['user'];
     if(isset($user_ban))
     {
     ?>
     <form name="file_ban" method="post" action="?action=file">
     Username: <input type="text" name="user" value="<?php echo $user_ban; ?>"><br />
     Length of Ban: <select name="time">
     <option value="1">1 Day</option>
     <option value="3">3 Days</option>
     <option value="5">5 Day</option>
     <option value="7">1 Week</option>
     <option value="15">15 Days</option>
     <option value="30">1 Month</option>
     <option value="90">3 Months</option>
     <option value="99999999999">&#8734; Infinity (Permaban)</option>
     <option value="00">IP Ban (Does not expire)</option>
     </select><br />
     Reason: <br />
     <textarea name="reason" cols="50" row="4"></textarea><br />
     <input type="submit" value="Ban">
     <?php
 
 
     }else{
 
 
     }
 
 
 
 
     }
 }else{   // If session is not set
 header("Location: index.php");
 }
?>


If you need any explanation of what anything does, just please ask.

Thank you!

Hi All,

I am trying to submit multiple form fields, whereby I am asking users to supply specific files. I can get it to upload a single file correctly, however when I increase this to 2 or 3, it's using the same file for all of them. I have used print_r($_FILES) to check everything with the files seems to be OK, and it all looks OK. I need to be able to pair the files, so that's why I haven't used the multiple option.

I have tried changing the variables so they are completely different, but I am at a total loss right now.
 

## First Document
if(!empty($_FILES["dc1"])){ 
	$fileName1 = htmlspecialchars_decode((basename($_FILES["dc1"]["name"]))); 
	$fileTypeA1 = pathinfo($fileName1, PATHINFO_EXTENSION); 
    $targetFilePath1 = $uploadDir . $uID . '-' . $randnum . '.' .$fileTypeA1; 
 	
	if(move_uploaded_file($_FILES["dc1"]["tmp_name"], $targetFilePath1)){ 
		$uploadedFile1 = $targetFilePath1; 
		}
	} 

## Second Document
if(!empty($_FILES["dc2"])){ 
	$fileName2 = htmlspecialchars_decode((basename($_FILES["dc2"]["name"]))); 
	$fileTypeA2 = pathinfo($fileName2, PATHINFO_EXTENSION); 
    $targetFilePath2 = $uploadDir . $uID . '-' . $randnum . '.' .$fileTypeA2; 
    
	if(move_uploaded_file($_FILES["dc2"]["tmp_name"], $targetFilePath2)){ 
    	$uploadedFile2 = $targetFilePath2; 
     }
	} 

 

Edited October 13, 2020 by SH1989
Clean code up

I am trying to process a simple registration form:-

Code: [Select]
<form method="POST" action="regproc.php">

<p>Choose a username:<br /><input name="nick" type="text" /></p>

<p>Choose a password:<br /><input name="pwd" type="password" /></p>

<p>Re-type password:<br /><input name="pwd2" type="password" /></p>

<p>Sex:<br /><input name="sex" type="text" /></p>

<p>Email address:<br /><input name="email" type="text" /></p>

<p><input name="submit" type="button" value="Hit me NOW!" /></p>

</form>
but it does not call the relevant processing file "regproc.php" when the submit button is hit. I can't figure out just why this is and would appreciate any ideas. I know that the solution is probably very simple and staring me in the face if only I could see it...

This topic has been moved to Third Party PHP Scripts.

http://www.phpfreaks.com/forums/index.php?topic=358327.0

can someone visually just read through my code and let me know if this looks like it'll work? I'm not getting any errors in my IDE so now I want to double check the structure



<?php
require_once '/usr/local/cpanel/3rdparty/lib/php/Mail.php';

$db_server = 'localhost';
$db_user = '-----';
$db_pass = '-----';

$dbc = mysql_connect ($db_server, $db_user, $db_pass);
if (!$dbc) { 
    die(mysql_error());
    header ('Location: /contact');
    exit;
}

if ($_POST['contactsent'] != 'yes') {
    header ('Location: /contact');
    exit;
    
} else {
    
if (is_array($_POST)) {
        foreach ($_POST as $key => $value) {
            $_POST[$key] = mysql_real_escape_string(stripslashes($value));
        }
    }

    $RequestType      = $_POST["RequestType"];
    $ConsumerBusiness = $_POST["ConsumerBusiness"];
    $GlobalLocation   = $_POST["GlobalLocation"];
    $FirstName        = strtolower(str_replace("'","''",$_POST["FirstName"]));
    $FirstName        = strtoupper(substr($FirstName,0,1)).substr($FirstName,1);
    $LastName         = strtolower(str_replace("'","''",$_POST["LastName"]));
    $LastName         = strtoupper(substr($LastName,0,1)).substr($LastName,1);
    $Email            = strtolower(str_replace("'","''",$_POST["Email"]));
    $Title            = strtolower(str_replace("'","''",$_POST["Title"]));
    $Title            = strtoupper(substr($Title,0,1)).substr($Title,1);
    $Company          = strtolower(str_replace("'","''",$_POST["Company"]));
    $Company          = strtoupper(substr($Company,0,1)).substr($Company,1);
    $Address          = strtolower(str_replace("'","''",$_POST["Address"]));
    $Address          = strtoupper(substr($Address,0,1)).substr($Address,1);
    $City             = strtolower(str_replace("'","''",$_POST["City"]));
    $City             = strtoupper(substr($City,0,1)).substr($City,1);
    $State            = $_POST["State"];
    $Zip              = $_POST["Zip"];
    $Phone            = $_POST["Phone"];
    $F              = $_POST["F"];
    $ProductDesc      = $_POST["ProductDesc"];
    $Comment          = $_POST["Comment"];

    if ($GlobalLocation == "Canada"):
        $SendTo="canadainfo@------.com";
    elseif ($GlobalLocation == "Central America"): 
        $SendTo="customer.service@------.com.pa";
    elseif ($GlobalLocation == "Europe"):
        $SendTo="marketing@-----.uk";
    elseif ($GlobalLocation == "Mexico"):
        $SendTo="ventas@------.com.mx";
    else:
        $SendTo="info@------.com";
    endif;

function dbSet($fields, $source = array()) {
    $set='';
    if (!source) $source = &$_POST;
    foreach ($fields as $field) {
        if (isset($source[$field])) {
            $set.="`$field`='".mysql_real_escape_string($source[$field])."', ";
        }
    }
    return substr($set, 0, -2);
}

// INSERT INTO DATABASE
            mysql_select_db("new_contact",$dbc) or die("Could not select new_contact");
            
$fields =   explode(" ", "RequestType ConsumerBusiness GlobalLocation FirstName LastName Email Title Company Address City State Zip Phone F ProductDesc Comment");
            $query = "INSERT INTO new_contact SET ".dbSet($fields, $_POST);
            mysql_query($query);

// SETUP EMAIL
$Bodycopy = "This information was submitted via the ------.com website and sent to you because of the location 
        identified by the user. <br>If this has reached you in error, please forward this email to info@------.com";
$Bodycopy. "<br>----------------------------------------------------------------------------------------------<br><br>";

        if ($RequestType != "")      $Bodycopy. "What kind of information do you need? : " .$RequestType. "<br>";
if ($ConsumerBusiness != "") $Bodycopy. "What type of customer or vendor are you? : " .$ConsumerBusiness. "<br>";
if ($GlobalLocation != "")   $Bodycopy. "Global Location : " .$GlobalLocation. "<br>";
if ($Company != "")          $Bodycopy. "Company : " .$Company. "<br>";
if ($FirstName != "")        $Bodycopy. "First Name : " .$FirstName. "<br>";
if ($LastName != "")         $Bodycopy. "Last Name : " .$LastName. "<br>";
if ($Title != "")            $Bodycopy. "Title : " .$Title. "<br>";
if ($Email != "")            $Bodycopy. "Email : " .$Email. "<br>";
if ($Address != "")          $Bodycopy. "Address : " .$Address. "<br>";
if ($City != "")             $Bodycopy. "City : " .$City. "<br>";
if ($State != "")            $Bodycopy. "State : " .$State. "<br>";
if ($Zip != "")              $Bodycopy. "Zip/Postal Code : " .$Zip. "<br>";
if ($Phone != "")            $Bodycopy. "Phone : " .$Phone. "<br>";
if ($F != "")              $Bodycopy. "F : " .$F. "<br>";
if ($ProductDesc != "")      $Bodycopy. "UPC or product description : " .$ProductDesc. "<br>";

$Bodycopy. "<br>----------------------------------------------------------------------------------------------<br><br>";
        
if ($Comment != "")          $Bodycopy. "Comments : <br>" .$Comment. "<br>";

        $Bodycopy. "<br><br>";
        $Bodycopy. $IP = $_SERVER["remote_addr"];
        
// PROCESS EMAIL

// mail server info...

        $from = $SendTo;
        $to = "Do Not Reply <donotreply@------>";
        $subject = "Website Contact : " . $GlobalLocation;
        $body = $Bodycopy;
        $host = "mail.------";
        $port = "25";
        $username = "donotreply@-------";
        $password = "-------";
        
        $headers = array ('From' => $from,
        'To' => $to,
        'Subject' => $subject);
        $smtp = Mail::factory('smtp',
        array ('host' => $host,
         'auth' => true,
         'port' => $port,
         'username' => $username,
         'password' => $password));
        
        $mail = $smtp->send($to, $headers, $body);
        
        if (PEAR::isError($mail)) {
        echo("<p>" . $mail->getMessage() . "</p>");
        } else {
        echo("<p>Message successfully sent!</p>");
        }

// MAKE SURE DB CONN IS CLOSED
        mysql_close($dbc);

// REDIRECT TO THANK YOU PAGE
        header ('Location: /index.php?option');
        exit();

}

?>

Hi all,

I am wondering if nayone can spot why more form is not processing, basically the page just loads afresh once details have been entered and submit button clicked

The page is called client.php
<?php
session_start();

if (isset($_POST['submit']))
{
include('config.php');
$username = $_POST['username'];
$password = md5($_POST['password']);
$query = mysql_query("SELECT email,password FROM customers WHERE email='$username' AND password = '$password'");
$count=mysql_num_rows($query);


if($count==1)
{
$query1= mysql_query("SELECT id FROM customers WHERE email='$username'");
echo mysql_error() ;
while($row = mysql_fetch_assoc($query1))
   {
$id = $row['id'];
$_SESSION['id'] = $id;
$_SESSION['logged'] = "SET";
header("Location: client.php?id=$id");
}
}

else
{
echo "<script>alert('Incorrect Login Details')</script>";
}
}
?>

<link href="styles/style.css" rel="stylesheet" type="text/css" />
<link href="styles/form_clean.css" rel="stylesheet" type="text/css" />
<script type="text/javascript" src="scripts/pageload.js"></script>
<script type="text/javascript">
 function swapImages(that) {
  that.src =  (that.src.indexOf('buttonselected')>-1) ? ("images/"+that.id+"button.gif") : ("images/"+that.id+"buttonselected.gif");
}
</script>
<link href="styles/form_clean.css" rel="stylesheet" type="text/css" />

</head>

<body>

<div id="main">
<div id="links">
<a href="index.php"><img src="images/homebutton.gif" alt="Home Button" class="buttons" id="home" onmouseover="swapImages(this)" onmouseout="swapImages(this)" /></a>
<a href="javascript:ajaxpage('packages.php', 'content');"><img src="images/packagebutton.gif" alt="Packages Button" class="buttons" id="package" onmouseover="swapImages(this)" onmouseout="swapImages(this)" /></a>
<a href="javascript:ajaxpage('purchase.php', 'content');"><img src="images/purchasebutton.gif" alt="Purchase Button" class="buttons" id="purchase" onmouseover="swapImages(this)" onmouseout="swapImages(this)" /></a>
<a href="javascript:ajaxpage('contact.php', 'content');"><img src="images/contactabutton.gif" alt="Contact Button" class="buttons" id="contacta" onmouseover="swapImages(this)" onmouseout="swapImages(this)" /></a>
          <a href="client.php"><img src="images/clientbutton.gif" alt="Client Button" class="buttons" id="client" onmouseover="swapImages(this)" onmouseout="swapImages(this)" /></a>
</div>
    
    
    <div id="logobox"><img src="images/logo.png" alt="JollyHosting.com - Simplified Reseller Hosting"/>
</div>
    <div id="content">
    <img src="images/gaptop.png" alt="seperator" />
    
    <?php

if(!isset($_SESSION['logged']))
{
?>
       <h2> Please Login</h2>
        <div id="login">
    <form class="clean" action="client.php" method="post">
      <ol>
        <li>
          <fieldset>
            <legend>Login</legend>
            <ol>
              <li>
                <label for="username">Email Address</label>
                <input type="text" id="username" name="username" value="" />
              </li>
              <li>
                <label for="password">Password</label>
                <input type="password" id="password" name="password" value="" />
              </li>
            </ol>
          </fieldset>
        </li>
      </ol>
      <p style="text-align:right;">
        
        <input type="submit" value="OK" />
      </p>
    </form>
    </div>
<?php
}

else
{
echo "loggin in";
}
    ?>
  </div>
    
    <?php include('footer.php');?>
</div>
</body>
</html>



Many thanks

Hola Everybody !!

I'm putting together a web app similar to Digg and was wondering if there is a function or code example I can use to avoid users submitt the same url.

For example:
Right now the user can submit;
1. http://www.example.com?post01
2. http://example.com?post01
3. www.example.com?post01

I want the web app to check if the link has been submitted by the user first and look for duplicate submission.

Any ideas ?

Thank you,

V.

Okay, so I have a neat little website and I'm having some issue with some quality-of-life improvements.   Namely, the user clicks a button which starts a server-side operation that can take up to 20 to 30 seconds.   I want a little message to appear below the button that says, "Operation started. This may take upwards of 20 to 30 seconds depending on traffic."   As of now, I have the typical 

<form action="post" action="<?php echo $_SERVER['PHP_SELF'];?>">
    ...
    <input type="submit" name="submit" value="Make PDF" />
</form>
<?php   
    if (isset($_POST["submit"]))
    {
        ...
    }
?>

The only problem is, part of my PHP code must communicate with a Java server that I have running on the server itself.   So how the site works is, there's the computer I'm renting out and it's running Apache and a custom Java server I wrote myself. Apache handles the web request and upon form submission, PHP opens a socket with the Java server and begins the task. PHP then waits for the connection to close.  

HI All -
Hoping you can help me out here with an issue that's preventing me from posting a form.  I am still stumbling my way through this. 

I have a form that submits to itself with php code that uses a $curlhandle to post to a remote server, return xml data and parse it. The submission to the remote server works perfectly and the data returned is fine.

The problem I am having is that when the form page initially loads in the browser, it thinks the form is already trying to submit, and it returns an error message for the first blank field.  The error message is from the remote site. There is no database involved with this and the information does not need to be saved, just displayed on the same page the form resides on.

So, is there a way I can load the page with the form without getting the error message from the remote site?

hi i have the following contact us form which works fine. i need lil more tweaking.
Right now when i submit the form it displays the information "blah blah", "the form has been submitted successfully" and also the form.
What i want to do is if the form has been submitted successfully i need not display the form again.
I need to display the data before the form field:
"Blah Blah"(information before the form code)
"the form has been submitted successfully"
I do not need to display the form if it has been a successful submission.
here is my code:

Code: [Select]
<?php

include($headerpath);

//change this to use mysql count function

$totalentriesrow = mysql_query("SELECT DISTINCT userid FROM user", $con);
$totalentriesrow = mysql_num_rows($totalentriesrow);

?>
<title><?PHP echo $site_name; ?> Advertising</title>
<BR><BR>
<table cellpadding="5"  cellspacing="1" bgcolor="white" border="0" width="900" align="center" style='border-top: 1px; border-right: 1px; border-left: 1px; border-bottom: 1px; border-color: black; border-style: solid;'>
<tr>
<td bgcolor='<?PHP echo $head; ?>' align='left'><b><font color='<?PHP echo $head_font_color; ?>' size='2' face='verdana'><?PHP echo $site_name; ?> Advertising</font></b>
Blah Blah Blah Blah
</td>

</tr>

<?

//echo '<center><h4><font color="blue"><br>CONTACT US<br></font></h4></center>';

// Create an empty array to hold the error messages.
$arrErrors = array();
//Only validate if the Submit button was clicked.
if (!empty($_POST['submit']))
 {

      // Each time theres an error, add an error message to the error array
      // using the field name as the key.
      if (empty($_POST['first_name']))
          $arrErrors['first_name'] = '<br><font color="red">Please provide your first name.</font>';
      if (empty($_POST['last_name']))
          $arrErrors['last_name'] = '<br><font color="red">Please provide your last name.</font>';
      if (empty($_POST['business_name']))
          $arrErrors['business_name'] = '<br><font color="red">Please provide your business name.</font>';
      if (empty($_POST['website_url']))
          $arrErrors['website_url'] = '<br><font color="red">Please provide a website url.</font>';
      if (empty($_POST['street_address']))
          $arrErrors['street_address'] = '<br><font color="red">Please provide your street address.</font>';
      if (empty($_POST['city']))
          $arrErrors['city'] = '<br><font color="red">Please provide your city name.</font>';
      if (empty($_POST['state']))
          $arrErrors['state'] = '<br><font color="red">Please provide your state.</font>';
      if (empty($_POST['zip']))
          $arrErrors['zip'] = '<br><font color="red">Please provide your zip.</font>';
      if (empty($_POST['country']))
          $arrErrors['country'] = '<br><font color="red">Please provide your country.</font>';
      if (empty($_POST['email_address']))
          $arrErrors['email_address'] = '<br><font color="red">A valid email address is required.</font>';
      if (empty($_POST['phone']) || (!is_numeric($_POST['phone'])))
          $arrErrors['phone'] = '<br><font color="red">Phone number cannot be empty and has to be numeric.</font>';
      if (empty($_POST['description']))
          $arrErrors['description'] = '<br><font color="red">Description cannot be empty.</font>';


      // If the error array is empty, there were no errors.
  // Insert form processing here.

      if (count($arrErrors) == 0)
      {


    $first_name=cleaninput($_POST['first_name']);
    $last_name=cleaninput($_POST['last_name']);
    $business_name=cleaninput($_POST['business_name']);
    $website_url=cleaninput($_POST['website_url']);
        $street_address=cleaninput($_POST['street_address']);
    $city=cleaninput($_POST['city']);
    $state=cleaninput($_POST['state']);
        $zip=cleaninput($_POST['zip']);
        $country=cleaninput($_POST['country']);
    $email_address=cleaninput($_POST['email_address']);
    $phone=cleaninput($_POST['phone']);
    $description=cleaninput($_POST['description']);

      $to = $advertising_contacts;
        $subject = "Advertisement Contact";
        $message="You have a new advertising contact<br>";
        $message.="<b>First name:</b> ".stripslashes($first_name)."<br><b>Last Name:</b> ".stripslashes($last_name);
        $message.="<br><b>Business Name:</b> ".stripslashes($business_name)."<br><b>Business Description: </b>".stripslashes($description)."<br><b>Business URL:</b> ".stripslashes($website_url);
        $message.="<br><b>Street Address:</b> ".stripslashes($street_address)."<br><b>City:</b> ".stripslashes($city);
        $message.="<br><b>State:</b> ".stripslashes($state)."<br><b>Zip:</b> ".stripslashes($zip)."<br><b>Country:</b> ".stripslashes($country);
        $message.="<br><b>Email:</b> ".stripslashes($email_address)."<br><b>Phone:</b> ".stripslashes($phone);
        $from = "webmaster@example.com";
        $headers  = 'MIME-Version: 1.0' . "\r\n";
        $headers .= 'Content-type: text/html; charset=iso-8859-1' . "\r\n";
        $headers .= 'From: Admin <Admin@groupbuilder.com>' . "\r\n";

     // Send email
     mail($to,$subject,$message,$headers);

       //escapeinput for inserting into database

     $first_name=escapeinput($first_name);
     $last_name=escapeinput($last_name);
     $website_url=escapeinput($website_url);
     $street_address=escapeinput($street_address);
     $city=escapeinput($city);
     $state=escapeinput($state);
     $zip=escapeinput($zip);
     $country=escapeinput($country);
     $email=escapeinput($email);
     $phone=escapeinput($phone);
     $description=escapeinput($description);
     $dateline=time();

       //Insert the details into database

     $insert_contacts=mysql_query("INSERT INTO adcontacts(first_name,last_name,email_address,phone,business_name,description,website_url,street_address,city,state,zip,country,dateline) VALUES('$first_name','$last_name','$email_address','$phone','$business_name','$description','$website_url','$street_address','$city','$state','$zip','$country','$dateline')") or die(mysql_error());

       echo "<center>Form Submitted Successfully</center><br>";

      }
      else
      {

        // The error array had something in it. There was an error.
        // Start adding error text to an error string.
        echo "<center>There was an error in the form<br></center>";

    $strError="";
        foreach ($arrErrors as $error)
        {
           $strError .= $error;
        }

      }
}
 ?>



<tr>
   <td>

<?
     echo "<table align= 'center' width='50%' style='border-top: 1px; border-right: 1px; border-left: 1px; border-bottom: 1px; border-color: black; border-style: solid;'>";
?>
<tr>
  <td>
   <form action="<?php echo $PHP_SELF;?>" method="post">
      <tr height='40'>
         <td>
           <font color="black"><B> First Name: </B></font>
         </td>
<td><input type="text" size ="40" name="first_name" value="<? if(!empty($strError)) {echo cleaninput($_POST['first_name']);}?>" />
            <?php if (!empty($arrErrors['first_name'])) echo $arrErrors['first_name']; ?>
</td>

      </tr>
      <tr height='40'>
     <td><font color="black"><B> Last Name: </B></font></td>
     <td><input type="text" size ="40" name="last_name" value="<? if(!empty($strError)) { echo cleaninput($_POST['last_name']);}?>"/>
     <?php if (!empty($arrErrors['last_name'])) echo $arrErrors['last_name']; ?>
             </td>
      </tr>

      <tr height='40'>
     <td><font color="black"><B> Email Address: </B></font></td>
     <td><input type="text" size ="40" name="email_address" value="<? if(!empty($strError)) { echo cleaninput($_POST['email_address']);}?>"/>
     <?php if (!empty($arrErrors['email_address'])) echo $arrErrors['email_address']; ?>
             </td>
      </tr>
       <tr height='35'>
       <td><font color="black"><B> Business Name: </B></font></td>
       <td><input type="text" size ="40" name="business_name" value="<? if(!empty($strError)) { echo cleaninput($_POST['business_name']);}?>" />
      <?php if (!empty($arrErrors['business_name'])) echo $arrErrors['business_name']; ?>
             </td>
      </tr>

      <tr>
         <td><font color="black"><B> Business Description: </B></font></td>
         <td ><textarea rows=7 cols=31 name="description"><? if(!empty($strError)) { echo cleaninput($_POST['description']);}?></textarea>
         <?php if (!empty($arrErrors['description'])) echo $arrErrors['description']; ?>
         </td>
      </tr>
       <tr height='40'>
       <td><font color="black"><B> Business URL: </B></font></td>
       <td><input type="text" size ="40" name="website_url" value="<? if(!empty($strError)) { echo cleaninput($_POST['website_url']);}?>" />
        <?php if (!empty($arrErrors['website_url'])) echo $arrErrors['website_url']; ?>
             </td>
      </tr>
         <tr height='40'>
         <td><font color="black"><B> Business Phone: </B></font></td>
         <td><input type="text" size ="40" name="phone" value="<? if(!empty($strError)) { echo cleaninput($_POST['phone']);}?>"/>
<?php if (!empty($arrErrors['phone'])) echo $arrErrors['phone']; ?>
             </td>
      </tr>
      <tr height='40'>
     <td><font color="black"><B> Street Address: </B></font></td>
     <td><input type="text" size ="40" name="street_address" value="<? if(!empty($strError)) { echo cleaninput($_POST['street_address']);}?>" />
<?php if (!empty($arrErrors['street_address'])) echo $arrErrors['street_address']; ?>
             </td>
      </tr>
      <tr height='40'>
     <td><font color="black"><B> City: </B></font></td>
     <td><input type="text" size ="40" name="city" value="<? if(!empty($strError)) { echo cleaninput($_POST['city']);}?>" />
<?php if (!empty($arrErrors['city'])) echo $arrErrors['city']; ?>
             </td>
      </tr>
       <tr height='40'>
     <td><font color="black"><B> State: </B></font></td>
     <td><input type="text" size ="40" name="state" value="<? if(!empty($strError)) { echo cleaninput($_POST['state']);}?>"/>
<?php if (!empty($arrErrors['state'])) echo $arrErrors['state']; ?>
             </td>
      </tr>
        <tr height='40'>
       <td><font color="black"><B> Zip: </B></font></td>
       <td><input type="text" size ="40" name="zip" value="<? if(!empty($strError)) { echo cleaninput($_POST['zip']);}?>"/>
<?php if (!empty($arrErrors['zip'])) echo $arrErrors['zip']; ?>
             </td>
      </tr>
      <tr height='40'>
     <td><font color="black"><B> Country: </B></font></td>
     <td>
     <select name="country">
     <option value="<? if(!empty($strError)) { echo $_POST['country'];}?>"><?echo cleaninput($_POST['country']);?></option>
     <?php foreach($array as $key=>$value){ ?>
     <option value="<?php echo $value; ?>"><?php echo $value; ?></option>

     <?php }?>
     </select>
<?php if (!empty($arrErrors['country'])) echo $arrErrors['country']; ?>
     </td>
</tr>
      <tr height='35'>
         <td></td>
         <td><input type="submit" name="submit" value="submit" /></td>
      </tr>

   </form>
   </tr>
   </td>
   </table>
   </td>
   </tr>
</table>

I'm not sure if this is exactly a coding help question, excuse me if its not.

I want to know what is the best & secure way to submit a form to itself.
I've tried to google the answer, but did not get a proper answer with explanation or may be I didnt use proper keywords to search it.

Out of these which one do i use?

Code: [Select]
// Leave the action field empty.

<form method="POST" action="">

//$PHP_SELF, also if i use echo $PHP_SELF my form does not work like it should.

<form method="POST" action="<?$PHP_SELF?>">

//$_SERVER['PHP_SELF'], same problem as $PHP_SELF, it doesnt work if i use echo.
<form method="POST" action="<?$_SERVER['PHP_SELF']?>">