PHP Form Processor Error Passback

Question

I have a basic PHP form page that contains quite a large amount of data that will be saved into about 4-5 different tables in MySql once it is all done. Since constructing this save routine will take a bit of PHP I'm looking to have the POST action to not point at PHP_SELF and instead a separate PHP file for processing.

Where all general data such as phone numbers, email, zip codes, etc. will be validated prior to the submit is passed to the processor script, if an error is returned by the processor...

What is the best practice way to point back to the original form page (HTTP_REFERER) while maintaining data input?

Form page:

<form action="processor.php" action="post">
<!-- lots of fields -->
<input type="submit" id="submitButton" name="Save" value="Save" />
</form>

Processor page:

<?php
     if ( isset($_POST['date']) && ($_SERVER['HTTP_REFERER'] == "form.php") )
     {
          $errors = false;

          //attempt to put data in database

          if ( $errors )
          {
               //Pass back to the form.php page with error message and all data intact
          }
     }
?>

Answer 1

I have come across this problem before, how we solved this was to put all the fields into a session, then redirect back to form.php using header("Location: form.php");

When the data was posted to the form, we stored the $_REQUEST into a $_SESSION['post']; if the validation failed, we sent it back to the form, populated the fields and unset the session.

So for example

$_SESSION['post']['field_a'] = $_REQUEST['field_a'];
$_SESSION['post']['field_b'] = $_REQUEST['field_b'];

With some fancy naming conventions you can just loop this to make it easy.

Then on the Form page, we just checked to see if there was some data, or just echo the data regardless.

$str_field_a = @$_SESSION['post']['field_a'];
...
<input name="field_a" value="<?php echo $str_field_a; ?>" />
...
unset($_SESSION['post']);

This is probably a messy way of doing this, but it has proven effective for our purposes. Just thought I'd share.

Answer 2

I think you can do that using an array of error.

1. Set error flag false (if error occurs then set it true and so not store in database).

2. Check element 1, if error then store it in array $error['name'] = 'value'

3. Similarly check all elements, and store using same procedure.

4. In the end if error flag is set to false do not store in database and (if on the same page, you will be able to access the array on form where you want to display error message. )

   if(isset($error['elementname'])) echo $error['elementname']; 
   

below the page.

However, the best approach is to use an Object Oriented approach.

[UPDATE]

1. storing php objects on html form element and passing php objects through GET method?

2. how to send redirect page pass variables as post variables from a php script

Also I guess, storing the whole object in SESSION would not be a bad approach

Answer 3

I would send a post back to form.php containing errors and values. I use the same method in my personal project.

if ( $errors ) {
    ?><form action="form.php" method="post" name="error">
    <input type="hidden" name="errcode" value="<?php echo $errorcodes; /*or whatever message*/ ?>" />
    <input type="hidden" name="anotherdata" value="anothervalue" />
    <?php /*you can add all post datas here as hidden field*/  ?>
    </form>
    <script type="text/javascript">document.error.submit();</script><?php
}

And this is similar to my form.php

//first I set default blank variables for form
$formvalue="";
$formnumericvalue="";
//i set them, yay!

//if I get values from post.php, I update the values
if (isset($_POST['iserror'])) { //you can either echo a error message or update current data here, I'm showing this for both
    $formvalue=$_POST['formvalue'];//don't forget to validate these!
    $formnumericvalue=$_POST['formnumericvalue']; //don't forget to validate these!
}
//I also do this method for edit forms

//and finally I show the form
?>
<form name="form" method="post" action="post.php">
    <input type="text" name="formvalue" value="<?php echo $formvalue; ?>" />
</form>