Hello Everyone,
Here to give you some tips with handling input.
Handling input
Lets start with the form:
<form method='POST' action='php/echo_input.php'>
<p>Name:<input type="text" name="name"/></p>
<input type='submit' class='buttonlo2' value='Submit' />
</form>It’s a basic form and won’t look great but you can worry about that.
Take note of 'method=‘POST’ ’ and 'action=‘php/echo_input.php’ ’ this is important for the PHP and change the ‘action’ to where your PHP file is.
The method tells the form to ‘POST’ it to ‘php/echo_input.php’ when the Submit button is pressed.
You can set the method to ‘GET’ but this can be a Security issue when dealing with login forms and things.
‘GET’ posts the value of the form into the URL. So say if I entered ‘Billy’ into the form it would take me to ‘php/echo_input.php?name=Billy’
Ok, Now the php. I called my php file ‘echo_input.php’ but you can call your’s whatever but remember to change ‘action’
First we want to get the form data so lets do:
[php]
//Get form input
$name = $_POST=[‘name’];
[/php]
We set the name as a variable. ‘$_POST’ is what we use to get ‘POST’ data and ‘[‘name’]’ is what the name of the form text box is called.
Ok, now we could just echo the value of ‘$name’
[php]
//echo name
echo $name;
[/php]
But if I typed “Billy” it would display in Bold.
‘’ in HTML makes things bold.
So people could type HTML into the text box witch is a Security risk.
So, How do we stop it? Well by adding:
[php]
//Strip input
$name = htmlentities($name, ENT_QUOTES, “UTF-8”);
[/php]
What this does is converts the html to plain text.
So now it displays how they typed it ‘Billy’
Is that it? No!
There are also things like “Code injection” and “SQL Injection”
These things can be very dangerous but we can stop them just like the html:
[php]
//Strip input
$name = htmlentities($name, ENT_QUOTES, “UTF-8”);
$name = mysql_real_escape_string($name); //You only need this if you are sending input to a database
$name = stripslashes($name);
[/php]
Well there we have it.
[php]
<?php //Get input $name = $_POST['name']; //Strip input $name = htmlentities($name, ENT_QUOTES, "UTF-8"); $name = mysql_real_escape_string($name); //You only need this if you are sending input to a database $name = stripslashes($name); //Echo input echo $name; ?>[/php]
Thanks
Though I am going to see if it does work by leaving it blank, to see if it would work? Hmmm, it got me thinking. Though I highly doubt it for I’m trying to pass an value to the new page. I’ll get back.