Validating form input data

[stathis gotsis]

Hello everyone,

I am tying to come up with an elegant way to process some input data that
come from a form. When the user hits the 'Submit' button, i want the form to
appear again with the already entered valid data filled in and prompt the
user to re-enter the non-valid data. If all data is valid, i will forward to
an other .php page which enters the data into a database.

I tried to do this in the following way: the form always hits back on
itself, but when all data is valid i use the PHP:header() to redirect to the
data.php that performs the database insertion. The problem is that the data
is not available to data.php in the $_POST variable. How can i overcome this
problem? Any other subtle way to handle the whole thing? Any help
appreciated.

[David Haynes]

stathis gotsis wrote:

Hello everyone,

I am tying to come up with an elegant way to process some input data that
come from a form. When the user hits the 'Submit' button, i want the form to
appear again with the already entered valid data filled in and prompt the
user to re-enter the non-valid data. If all data is valid, i will forward to
an other .php page which enters the data into a database.

I tried to do this in the following way: the form always hits back on
itself, but when all data is valid i use the PHP:header() to redirect to the
data.php that performs the database insertion. The problem is that the data
is not available to data.php in the $_POST variable. How can i overcome this
problem? Any other subtle way to handle the whole thing? Any help
appreciated.

I would break the function a little differently.

1. Have a form (view) that is sensitive to $SESSSION. That is, it will
use the values in SESSION to populate any dynamic values to be displayed
in the form.
2. Have another process (controller) that:
a) processes $_POST or $_GET
b) if all is valid, does the insert/update and redirects to another
page (Your data has been saved.)
c) if all is not valid, populates the $SESSION with good values and
then redirects to the view form.

The whole thing is started by calling the controller. Since no data is
valid, it will redirect to the view.
The view then presents a form for filling in.
The user fills in the form and submits which then calls the controller.
The controller processes the form data and either updates/inserts it or
calls the view again.

If you encapsulate your database accesses into a class or set of classes
which are called from the controller, you will have a light-weight
implementation of a classic Model-View-Controller (MVC2) architecture.

-david-

[Manuel Lemos]

Hello,

on 04/30/2006 09:38 AM stathis gotsis said the following:

Hello everyone,

I am tying to come up with an elegant way to process some input data that
come from a form. When the user hits the 'Submit' button, i want the form to
appear again with the already entered valid data filled in and prompt the
user to re-enter the non-valid data. If all data is valid, i will forward to
an other .php page which enters the data into a database.

I tried to do this in the following way: the form always hits back on
itself, but when all data is valid i use the PHP:header() to redirect to the
data.php that performs the database insertion. The problem is that the data
is not available to data.php in the $_POST variable. How can i overcome this
problem? Any other subtle way to handle the whole thing? Any help
appreciated.

Nothing stops you from presenting the form and process it with the same
script.

You may want to take a look at this forms generation and validation
class that shows you how to do that. Additionally it generates your
forms with Javascript to validate the form also on the client site,
avoiding unnecessary server round trips just to tell the user the form
has invalid fields.

http://www.phpclasses.org/formsgeneration
--

Regards,
Manuel Lemos

Metastorage - Data object relational mapping layer generator
http://www.metastorage.net/

PHP Classes - Free ready to use OOP components written in PHP
http://www.phpclasses.org/

[stathis gotsis]

"David Haynes" <da***********@ sympatico.ca> wrote in message
news:Mp******** *******@fe17.us enetserver.com. ..

stathis gotsis wrote:

Hello everyone,

I am tying to come up with an elegant way to process some input data that come from a form. When the user hits the 'Submit' button, i want the form to appear again with the already entered valid data filled in and prompt the user to re-enter the non-valid data. If all data is valid, i will forward to an other .php page which enters the data into a database.

I tried to do this in the following way: the form always hits back on
itself, but when all data is valid i use the PHP:header() to redirect to the data.php that performs the database insertion. The problem is that the data is not available to data.php in the $_POST variable. How can i overcome this problem? Any other subtle way to handle the whole thing? Any help
appreciated.

I would break the function a little differently.

1. Have a form (view) that is sensitive to $SESSSION. That is, it will
use the values in SESSION to populate any dynamic values to be displayed
in the form.
2. Have another process (controller) that:
a) processes $_POST or $_GET
b) if all is valid, does the insert/update and redirects to another
page (Your data has been saved.)
c) if all is not valid, populates the $SESSION with good values and
then redirects to the view form.

The whole thing is started by calling the controller. Since no data is
valid, it will redirect to the view.
The view then presents a form for filling in.
The user fills in the form and submits which then calls the controller.
The controller processes the form data and either updates/inserts it or
calls the view again.

If you encapsulate your database accesses into a class or set of classes
which are called from the controller, you will have a light-weight
implementation of a classic Model-View-Controller (MVC2) architecture.

Thank you for your quick answer, i am heading towards the implementation you
suggested. Just another minor question: can i add an array variable to
SESSION? How can this be done?

[David Haynes]

stathis gotsis wrote:

"David Haynes" <da***********@ sympatico.ca> wrote in message
news:Mp******** *******@fe17.us enetserver.com. ..

stathis gotsis wrote:

Hello everyone,

I am tying to come up with an elegant way to process some input data that come from a form. When the user hits the 'Submit' button, i want the form to appear again with the already entered valid data filled in and prompt the user to re-enter the non-valid data. If all data is valid, i will forward to an other .php page which enters the data into a database.

I tried to do this in the following way: the form always hits back on
itself, but when all data is valid i use the PHP:header() to redirect to the data.php that performs the database insertion. The problem is that the data is not available to data.php in the $_POST variable. How can i overcome this problem? Any other subtle way to handle the whole thing? Any help
appreciated.

I would break the function a little differently.

1. Have a form (view) that is sensitive to $SESSSION. That is, it will
use the values in SESSION to populate any dynamic values to be displayed
in the form.
2. Have another process (controller) that:
a) processes $_POST or $_GET
b) if all is valid, does the insert/update and redirects to another
page (Your data has been saved.)
c) if all is not valid, populates the $SESSION with good values and
then redirects to the view form.

The whole thing is started by calling the controller. Since no data is
valid, it will redirect to the view.
The view then presents a form for filling in.
The user fills in the form and submits which then calls the controller.
The controller processes the form data and either updates/inserts it or
calls the view again.

If you encapsulate your database accesses into a class or set of classes
which are called from the controller, you will have a light-weight
implementation of a classic Model-View-Controller (MVC2) architecture.

Thank you for your quick answer, i am heading towards the implementation you
suggested. Just another minor question: can i add an array variable to
SESSION? How can this be done?

$my_array = array('one' => 1, 'two' => 2);
$_SESSION['my_array'] = $my_array;

or

$_SESSION['my_array'] = array('one' => 1, 'two' => 2);

-david-

[Jerry Stuckle]

stathis gotsis wrote:

Hello everyone,

I am tying to come up with an elegant way to process some input data that
come from a form. When the user hits the 'Submit' button, i want the form to
appear again with the already entered valid data filled in and prompt the
user to re-enter the non-valid data. If all data is valid, i will forward to
an other .php page which enters the data into a database.

I tried to do this in the following way: the form always hits back on
itself, but when all data is valid i use the PHP:header() to redirect to the
data.php that performs the database insertion. The problem is that the data
is not available to data.php in the $_POST variable. How can i overcome this
problem? Any other subtle way to handle the whole thing? Any help
appreciated.

Stathis,

I do things the same way you do - the page validates its own input and then uses
header() to move to the next page. But before the header() call, I store the
data in the $_SESSION variable.

I prefer validating the data in the same page that contains the data. It keeps
the code together and, IMHO, cleaner. Plus, if it isn't needed in the next
page, you don't even have to touch that page.

--
=============== ===
Remove the "x" from my email address
Jerry Stuckle
JDS Computer Training Corp.
js*******@attgl obal.net
=============== ===

[Jerry Stuckle]

Manuel Lemos wrote:

Hello,

on 04/30/2006 09:38 AM stathis gotsis said the following:

Hello everyone,

I am tying to come up with an elegant way to process some input data that
come from a form. When the user hits the 'Submit' button, i want the form to
appear again with the already entered valid data filled in and prompt the
user to re-enter the non-valid data. If all data is valid, i will forward to
an other .php page which enters the data into a database.

I tried to do this in the following way: the form always hits back on
itself, but when all data is valid i use the PHP:header() to redirect to the
data.php that performs the database insertion. The problem is that the data
is not available to data.php in the $_POST variable. How can i overcome this
problem? Any other subtle way to handle the whole thing? Any help
appreciated .

Nothing stops you from presenting the form and process it with the same
script.

You may want to take a look at this forms generation and validation
class that shows you how to do that. Additionally it generates your
forms with Javascript to validate the form also on the client site,
avoiding unnecessary server round trips just to tell the user the form
has invalid fields.

http://www.phpclasses.org/formsgeneration

And what happens if someone has javascript turned off?

NEVER rely on client side validation!

--
=============== ===
Remove the "x" from my email address
Jerry Stuckle
JDS Computer Training Corp.
js*******@attgl obal.net
=============== ===

[Ken Robinson]

Jerry Stuckle wrote (in part):

You may want to take a look at this forms generation and validation
class that shows you how to do that. Additionally it generates your
forms with Javascript to validate the form also on the client site,
avoiding unnecessary server round trips just to tell the user the form
has invalid fields.

http://www.phpclasses.org/formsgeneration

And what happens if someone has javascript turned off?

NEVER rely on client side validation!

Also, what happen if a hacker screen scraps your form and uses another
program to send information to your script directly to try to break it
or use it in ways you didn't think about.

Please go to the PHP Security Consortuim's web site <phpsec.org> and
read the different articles in both the "Articles" and "Library"
sections.

Ken

[John Dunlop]

Jerry Stuckle:

Manuel Lemos wrote:

You may want to take a look at this forms generation and validation
class that shows you how to do that. Additionally it generates your
forms with Javascript to validate the form also on the client site,
avoiding unnecessary server round trips just to tell the user the form
has invalid fields.

http://www.phpclasses.org/formsgeneration
And what happens if someone has javascript turned off?

I would assume the brunt of Manuel's class is its server-side
checking. The javascript is, as he said, an *addition*, an addition
which, when javascript happens to be available, obviates the need for a
round trip to the server just to say some field data was unacceptable.
Sounds good to me.
NEVER rely on client side validation!

Fair enough, bears repeating.

--
Jock

[John Dunlop]

Jerry Stuckle:

Manuel Lemos wrote:

You may want to take a look at this forms generation and validation
class that shows you how to do that. Additionally it generates your
forms with Javascript to validate the form also on the client site,
avoiding unnecessary server round trips just to tell the user the form
has invalid fields.

http://www.phpclasses.org/formsgeneration
And what happens if someone has javascript turned off?

I would assume the brunt of Manuel's class is its server-side
checking. The javascript is, as he said, an *addition*, an addition
which, when javascript happens to be available, obviates the need for a
round trip to the server just to say some field data was unacceptable.
Sounds good to me.
NEVER rely on client side validation!

Fair enough, bears repeating.

--
Jock