2

I am trying to write a script that fills out forms automatically and then automatically presses the submit button.

I have read that you can use curl to post HTTP requests, but what do you do when the form handles the post request with JavaScript, like the code below?

<form name="myform" action="javascript:void(0)" method="POST" onsubmit="return fancy_function(this)">
Matthias Braun
  • 32,039
  • 22
  • 142
  • 171
Narancha
  • 31
  • 1
  • 3
  • Why would you want to use curl to post the http request from PHP? If you want it to post to a different page - just change the html form action. – Peter Anselmo Jun 21 '10 at 00:02
  • Also, Curl is a server-side function. It doesn't matter to PHP whether the form was submitted with Javascript or not. – Peter Anselmo Jun 21 '10 at 00:09
  • Maybe I was not clear enough with my post. I want to fill out the form AUTOMATICLY using a script and Curl can send post-requests hence it can kind of fill out forms for me, but I don´t know how to specify the target url. I know that if I change the action to a document.php the post will be sent to document.php.. but that´s not the problem.. btw, thanks for taking your time and answering me! – Narancha Jun 21 '10 at 00:11
  • I know that php is server side, and I think that´s what I need. correct me if I am wrong. the script that I am writing is not at the same webpage as the form. I am not trying to handle the post request, I am trying to fill in an existing form online automaticly. – Narancha Jun 21 '10 at 00:15
  • does this pose a danger? isnt this why captcha was invented? – Randy Jun 21 '10 at 00:34
  • well, I will not harm anyone or any site but yes, this is probobly why captcha was invented. – Narancha Jun 21 '10 at 07:24
  • Please either mark an answer as correct or clarify your question if the answer is not what you are looking for :-) – Peter Anselmo Jun 24 '10 at 15:49

2 Answers2

2

Based off your answer to the comments above, what you want to do is not "fill out the form" with curl, but rather post the completed form to the same page the form would normally send to.

This is also called cross-site posting, and many developers specifically test for and don't allow it to improve security. This will also be much much harder if the form has a captcha.

Assuming that it still makes sense to do (I've used this technique before for a newsletter signup form), here's what you want to do:

To get the form's action url, you'll need to look through the Javascript code for the site and find where funcy_function() is defined. Then in the body of the function, you'll likely see the destination url. You'll also need to note the specific names of the form variables in the html. You'll need to setup your variables with the exact same names. Then your curl setup will look like this:

$url = 'http://www.targeturl.com';
$myvars = 'myvar1=' . $myvar1 . '&myvar2=' . $myvar2;

$ch = curl_init( $url );
curl_setopt( $ch, CURLOPT_POST, 1);
curl_setopt( $ch, CURLOPT_POSTFIELDS, $myvars);
curl_setopt( $ch, CURLOPT_FOLLOWLOCATION, 1);
curl_setopt( $ch, CURLOPT_HEADER, 0);
curl_setopt( $ch, CURLOPT_RETURNTRANSFER, 1);

$response = curl_exec( $ch );

This will send the post variables to the specified url, imitating what would normally happen from the form. The html that the page returns will be in $response if you want to parse or use it.

Peter Anselmo
  • 2,961
  • 1
  • 17
  • 12
0

If you want to use cURL:

You can capture every HTTP request (GET or POST forms) with Firefox Web-Tools:

Web-Tools -> Network -> send your form -> context menu of the form URL (right click on form script) -> Copy => copy as cURL address

More infos: https://everything.curl.dev/usingcurl/copyas

Hermann Schwarz
  • 1,495
  • 1
  • 15
  • 30