Member Avatar for Taffd

I post this solution to a form validation and redirect as an addition to a comment page written with dreamweaver. Unfortunately Dreamweaver does not provide server-side validation for php. You're expected to purchase an extension.
My problem
I have a comments page with a comment form. I wanted the comment input to a database if ok but if a user tried to input code or a link, I wanted to redirect them back to the form page without their comment input to the database. I also needed to work out where in the Dreamweaver written code to place my validation and redirect.

Here it is, I hope it helps somebody else.

$editFormAction = $_SERVER['PHP_SELF'];
if (isset($_SERVER['QUERY_STRING'])) {
  $editFormAction .= "?" . htmlentities($_SERVER['QUERY_STRING']);
}

if ((isset($_POST["MM_insert"])) && ($_POST["MM_insert"] == "comments"))
 {
 
 $comment = htmlentities($_POST['comment']);
 
function check_field1($comment)
{
if (preg_match("/</", $comment))
{
return TRUE;
}
}
$error=0; 
if(check_field1($comment))
{
  
  $error++;
   $insertGoTo = "comments.php";
  if (isset($_SERVER['QUERY_STRING'])) {
    $insertGoTo .= (strpos($insertGoTo, '?')) ? "&" : "?";
    $insertGoTo .= $_SERVER['QUERY_STRING'];
  }
  header(sprintf("Location: %s", $insertGoTo)); // $error=$error+1;
}

if($error == 0)
   $insertSQL = sprintf("INSERT INTO comments (comment, `day`, `month`, `year`) VALUES (%s, %s, %s, %s)",
                       GetSQLValueString($_POST['comment'], "text"),
                       GetSQLValueString($_POST['day'], "int"),
                       GetSQLValueString($_POST['month'], "text"),
                       GetSQLValueString($_POST['year'], "int"));

  mysql_select_db($database_connection, $connection);
  $Result1 = mysql_query($insertSQL, $connection) or die(mysql_error());

  $insertGoTo = "comments.php";
  if (isset($_SERVER['QUERY_STRING'])) {
    $insertGoTo .= (strpos($insertGoTo, '?')) ? "&" : "?";
    $insertGoTo .= $_SERVER['QUERY_STRING'];
  }
  header(sprintf("Location: %s", $insertGoTo));
  }
  • 7 Contributors
  • 11 Replies
  • 261 Views
  • 2 Years Discussion Span
  • Latest Post Latest Post by Netprof

Dani AI

Generated

Good starting point from — server‑side checks are necessary because client‑side JavaScript can be bypassed. A few practical improvements and gotchas that tie together the threads from , and :

Server‑side validation and flow

  • Validate on the server, then use a Post/Redirect/Get pattern so form resubmits are avoided (send a 303 or 302 and call exit after header()). Put processing at the very top of the PHP page (or use a separate handler) so headers can be sent reliably; Dreamweaver templates sometimes output HTML before PHP, which will break redirects.

Storage and XSS/SQL safety

  • Don’t apply htmlentities() before storing. Store the submitted text (or a validated/sanitized variant) and escape on output with htmlspecialchars() so data isn’t double‑encoded. Move away from old mysql_* calls; use PDO or mysqli with prepared statements to prevent SQL injection and to be compatible with modern PHP.

Preserving input and error reporting

  • If you want to return users to the form with their previous input and error messages, save errors/old values in $_SESSION (or re-render the form immediately) rather than stuffing data into the query string. This keeps sensitive content out of URLs and avoids broken encodings.

Mail and redirects (for )

  • If the form’s action is a mailto: URL the browser will open the user’s email client (that explains the Explorer prompt). To avoid that and control subject/format consistently, post to a PHP script and send mail server‑side (PHP mail() or a library like PHPMailer using SMTP).

Minimal pattern (illustrative, not a drop‑in):

if ($_SERVER['REQUEST_METHOD']==='POST') {
  // validate $comment, etc.
  if ($errors) { $_SESSION['form_errors']=$errors; header('Location: /form.php', true, 303); exit; }
  $stmt = $pdo->prepare('INSERT INTO comments (comment,day,month,year) VALUES (?,?,?,?)');
  $stmt->execute([$comment,$day,$month,$year]);
  header('Location: /thanks.php', true, 303); exit;
}

Security notes: add CSRF tokens, validate email with filter_var(), and consider CAPTCHA or spam filtering for open comment forms.

Recommended Answers

All 11 Replies

Member Avatar for Designer_101

hi
Is this echoing out properly, or do you just need help with the javascript validation ?

Member Avatar for Taffd

hi
Is this echoing out properly, or do you just need help with the javascript validation ?

Hi Designer,
I'm not actually asking for help here, I've posted this as a solution to the problem I posed here and in other posts. The above code works successfully. I could extend it with error messages and reproduction of the original comment to be edited but I decided to put a warning on the comments page not to post links or code, or the comment would be deleted.

Re javascript, I already have js client-side validation with error messages. Thank you anyway for your interest in this thread.

Taffd

Member Avatar for judiglidden

I am not sure if I am having a simoilar problem or it just sounds smilir to a new bie. I have acreated a form,
I have redirected it to a "thank you " at . Yet, I do not get the confirmation page and I can't figure it out. Also, In Explorer, when i hit th e the submit button I get a message "am I sure I want to send this from my email address"? and it changes the subject line. Is this something that can be eliminated? Thanks!

Member Avatar for nav33n

Yep.. Can you show us the code ?

Member Avatar for vssp

i have also need the solution

Member Avatar for nav33n

What is the problem actually ? Because the OP wasn't asking for any help !

Hi Designer,
I'm not actually asking for help here, I've posted this as a solution to the problem I posed here and in other posts. The above code works successfully.

Member Avatar for judiglidden

What is the problem actually ? Because the OP wasn't asking for any help !

I am not sure if you are replying to my post or another.
There are two problems:
Problem 1:
I have created a form, you can view it at:
I want to redirected it to a "thank you " at .
What code would I use here? And where do I put it?

Problem 2:
When filling out the form in Explorer, after I hit the the submit button I get a message "am I sure I want to send this from my email address"? ...it brings up the person’s email application and creates a message then you hit send. Is that going to work with everyone’s email apps? What if they just used web-based email?
I would like to eliminate those extra boxes, is there a way to have it generate that email il message internally without having the additional step of launching the email application.
Most forms I submit online like that don’t have the additional step/s after hitting submit. Lastly when the information is forwarded to me (the recipient), it seems to change the “subject” from Lifespring Report Form to “emailing . . “ So I want to eliminate the extra steps here and the changing of the subject line.

Thanks, Judi

Member Avatar for nav33n

I am not sure if you are replying to my post or another.
There are two problems:
Problem 1:
I have created a form, you can view it at:
I want to redirected it to a "thank you " at .
What code would I use here? And where do I put it?

By using a header function. Your page should be a php page and not html. I mean, should be to use the php functions. Or you can configure apache so that it parses html files using a php parser(which is lil complicated for time being). After doing whatever you wanna do with the posted form values, use this. header("location: "); This will redirect the user to "Thank you" page.

Problem 2:
When filling out the form in Explorer, after I hit the the submit button I get a message "am I sure I want to send this from my email address"? ...it brings up the person’s email application and creates a message then you hit send. Is that going to work with everyone’s email apps? What if they just used web-based email?
I would like to eliminate those extra boxes, is there a way to have it generate that email il message internally without having the additional step of launching the email application.
Most forms I submit online like that don’t have the additional step/s after hitting submit.

This has something to do with the way you have written your script. You are probably having a javascript alert to confirm the sending of email. I don't know about person's email application. We need to look at the code to know what you are talking about.

Lastly when the information is forwarded to me (the recipient), it seems to change the “subject” from Lifespring Report Form to “emailing . . “ So I want to eliminate the extra steps here and the changing of the subject line.

Thanks, Judi

You can use the mail function provided by php. AFAIK, php doesn't change any subject line! Again, you should show us your script to understand the problem.

Cheers,
Nav

Member Avatar for elinenash

very diffuicult lesson, i want to understant how can I post information registeration to my email. thanks

Member Avatar for Designer_101

Oh Im sorry! There seems to be some kind of mistake. My post isn't meant for this thread. Thats why it obviously doesn't make sense!

Sorry!

:)

Member Avatar for Netprof

Hmm not being a php master or guru i might not be correct but this seems like a minor code error do you have a code scan tool other than dreamweaver to make sure yourr code is validated?

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.