PHP script executes IF statement even no POST has been done

Question

I have two PHP script, and it seems the second script is not handling the $_POST correctly.

a.php

Important part:

echo "<form action='b.php' method='post'>";
echo "<input type='submit' name='add' value='Add new items'>";
echo "</form>";

b.php

Important parts:

$error_variable1="";

if ($_SERVER["REQUEST_METHOD"] == "POST")  {
    if (empty($_POST["something1"])) {
    $error_variable1="not correct";
    }
}

echo '<form action="'.htmlspecialchars($_SERVER["PHP_SELF"]).'" method="post">';
echo '<textarea name="something1" rows="1" cols="10"></textarea>';
echo $error_variable1;

echo '<input type="submit" name="evaluate" value="Checking inputs">';
echo "  </form>";

Unfortunately even at the first start of b.php it displays / gives value to $error_variable1 as "not correct."

But why is it working like this ? The user hasn't pressed the submit button yet. I want to give a "not correct" value for this variable when the "evaluate" submit button pressed.

Edit:

I am suspicious about that probably the POST (submit) from a.php is messing my b.php. What I would like is to display a text form with a submit button. When submit button has pressed ($POST) and the textarea is empty, then I want to show an error message to the user (not correct) and display the form again.

http://stackoverflow.com/questions/409351/post-vs-serverrequest-method-post — Martin, Apr 10 '16 at 14:46
Better use `isset(...)` instead of `empty(...)` and make sure you put NOT (`!`) in front of both. — ForceMagic, Apr 10 '16 at 14:48
if what you have for b.php is complete, it's missing a closing brace `}`. However, it's hard to figure out exactly what you want to do here. — Funk Forty Niner, Apr 10 '16 at 14:48
`b.php` process values posted by `a.php`. So you have to modify your condition to differentiate `a` and `b` check. If you have nothing to check from requests coming from `a.php`, replace `a.php` form with a link (or replace `POST` method with `GET`) — fusion3k, Apr 10 '16 at 14:49
Again, I don't know what you're trying to do here. I see an input with `Add new items` and this tells me you're probably using some JS to add items and trying to pass those to the 2nd page. I'm going to have to pass on this one. I'll just "watch" ;-) — Funk Forty Niner, Apr 10 '16 at 14:55

mertizci · Accepted Answer · 2016-04-10T15:02:02.953

2

Change empty($_POST["something1"]) to empty($_POST["something1"]) && $_POST["evaluate"]

edited Apr 10 '16 at 15:02

answered Apr 10 '16 at 14:47

mertizci

538
3
12

I doubt this is the solution. – Funk Forty Niner Apr 10 '16 at 14:50
@Fred-ii- I think he sends the post request to b.php, and $_POST["something1"] already empty its shows "not correct". – mertizci Apr 10 '16 at 14:52
I for one have no idea what the OP wants to do here. – Funk Forty Niner Apr 10 '16 at 14:53
@Fred-ii- Whats the meaning of OP ? – mertizci Apr 10 '16 at 14:54
2

OP: *Original Poster/Person* ;-) – Funk Forty Niner Apr 10 '16 at 14:55
1

@mertizci It means the person who asks the question. It stands for **Original Poster** – Panda Apr 10 '16 at 14:55
Fred -ii-: I am suspicious about that probably the POST (submit) from a.php is messing my b.php. What I would like to display a text form with a submit button. When submit button has pressed ($POST) and the textarea is empty, then I want to show an error message to the user (not correct) and display the form again. – Tass Mark Apr 10 '16 at 14:57
1

@TassMark that should be part of your question and for future visitors to the question today/or later. – Funk Forty Niner Apr 10 '16 at 14:57
1

@TassMark so change your `if (empty($_POST["something1"]))` with `if (empty($_POST["something1"]) && $_POST["evaluate"])`, i also edited my answer – mertizci Apr 10 '16 at 15:01
Thank you Fred -ii- and mertizci. – Tass Mark Apr 10 '16 at 15:09

Panda · Answer 2 · 2016-04-10T15:03:29.870

2

You can use strlen() to check if variable is set.

This will count the number of digits entered and will return false when textarea is empty as the string length will be 0.

if (!strlen(trim($_POST['something1']))) {
    $error_variable1="not correct";
}

Alternatively, check if the submit button is clicked:

if (isset($_POST['evaluate'])) {
    if (empty($_POST["something1"])) {
        $error_variable1="not correct";
    }
}

More information on isset(): http://php.net/manual/en/function.isset.php.

edited Apr 10 '16 at 15:03

answered Apr 10 '16 at 14:47

Panda

6,955
6
40
55

1

No, it does not. Have a look at this: http://stackoverflow.com/questions/7191626/isset-and-empty-what-to-use – ForceMagic Apr 10 '16 at 14:49
1

`isset()` on a textearea won't do much good here. `isset()` is mostly effective with radio/checkbox. – Funk Forty Niner Apr 10 '16 at 14:51
2

you are right @ForceMagic I got a momentary muddle between `$var` and `$_POST['var']`. – Martin Apr 10 '16 at 14:54

score 2 · Answer 3 · edited May 23 '17 at 12:24

1) CSRF: people from other websites can choose to submit forms to your form handler, therefore you should add a Cross Site Request Forgery prevention value into a hidden field in your form, that updates every time the form is loaded, typically paired with a $_SESSION value. Read more on this.

Using this unique "key" value you can then simply check at the top of your page if this POSTed key value is the correct value and that will confirm for you that the form has been posted.

so

A.php:

session_start();
$_SESSION['obscure'] = some obscurevalue generated anew every page load.
echo "<form action='b.php' method='post'>";
echo "<input type='submit' name='add' value='Add new items'>";
echo "<input tye='hidden' name='key' value='".$_SESSION['obscure']."'>
echo "</form>";

Then sends to b.php:

session_start();
if($_POST['key'] == $_SESSION['obscure'] && !empty($_POST['key'])){
   //This code will only run if the form has been correctly submitted.
}

The outcome of this is that you can be more sure that your code is run in the order it is intended and you can use the POSTED key value to confirm form submission.

As an aside as well it is bad practise to use PHP_SELF for form redirects. Use a static reference or use a properly uneditable value, as PHP_SELF can be abused by the end user.

score 1 · Answer 4 · edited Apr 10 '16 at 15:58

1

Change the following code segment in your code

if (empty($_POST["something1"])) {}

to the below one.

if (strlen($_POST['something1']) > 0) {}

edited Apr 10 '16 at 15:58

Dinidu Hewage

2,169
6
40
51

answered Apr 10 '16 at 15:01

harry

483
2
12

" " would return true – Martin Apr 10 '16 at 15:02

score 0 · Answer 5 · answered Apr 10 '16 at 15:03

You should definetly choose isset()! While empty() will return true even if its null, isset() will not!

empty() just checks if the given variable got a value. This can be anything! Int, Float, String, Object and also NULL - it does not matter. It will return true.

isset() instead will return true if the variable exists and is not null.

better choose isset() in this content ;)

EDIT:

see here: http://php.net/manual/en/function.empty.php

and here: http://php.net/manual/en/function.isset.php

From what I remember, using `isset()` for `` will always return TRUE, *regardless*. — Funk Forty Niner, Apr 10 '16 at 15:06

PHP script executes IF statement even no POST has been done

5 Answers5