Re: Using PHP to POST a form (and go to the page)?

OK. Here's why I want to do this... I'm considering using another website to process transactions for my site. To use their site, you POST a form to their secure server. This form includes a bunch hidden variables for things like item number, item cost, shipping cost, etc. If I simply used this form on my page, someone who knew what they were doing (just a little bit) could view the source, see that it was just a form and spoof it. They could reset the cost of something that was $10 and make it $1. I was thinking that I could make a little harder to spoof if I had the user just go to my product page that DID NOT have the form with the hidden vars. They would click on a "purchase" button that would send them to an intermediate page that would create the actual POST that the other website was expecting. Then, PHP would do the POST and send the user on his way. Not perfect, but better than the plain ol' form just waiting to be spoofed. Now, back to the question... Can I do what I'm trying to do? Or, is there a better way to get around this problem? Thanks, JRB jeremy brand <jeremy@nirvani.net> wrote: > > The client has to initiate the POST. Maybe you could have that page > contain javascript that does the POST, however, this only works on a > percentage of the browsers in the world, and is not a perfect > solution. > > -jeremy brand > > Jeremy Brand :: Sr. Software Engineer :: 408-245-9058 :: jeremy@nirvani.net > http://www.JeremyBrand.com/Jeremy/Brand/Jeremy_Brand.html for > more > Get your own Free, Private email at http://www.smackdown.com/ > - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - > At least for the people who send me mail about a new language that > they're designing, the general advice is: do it to learn about > how to write a compiler. --Dennis Ritchie > > On Wed, 6 Dec 2000, Jay Beaton wrote: > > > Date: Wed, 6 Dec 2000 19:27:02 -0500 > > From: Jay Beaton <jrb@leagueoffice.com> > > To: php-general@lists.php.net > > Subject: Re: [PHP] Using PHP to POST a form (and go to the page)? > > > > That's EXACTLY my question... I want to know if I can use PHP to > > simulate an actual POST... > > > > 1) The user goes to Page A. > > 2) PHP does some background processing, creating and sending the POST > > vars to Page B. > > 3) The user ends up on Page B as if they had POSTed a form to it (with > > HTTP_POST_VARS not empty). > > > > Is it possible? It's GOTTA be possible, right???? Anything is > > possible with PHP... > > > > > > Thanks, > > JRB > > > > jeremy brand <jeremy@nirvani.net> wrote: > > > > > > Yes HTTP_POST_VARS will be empty (or non-existant rather). If you > > > want HTTP_POST_VARS to be not empty, then then actually have to POST! > > > > > > :) > > > -jeremy brand > > > > > > > No, that'll send the user to the page, but not as if they had just > > > > POSTed a form to that page (i.e. $HTTP_POST_VARS will be empty). > > > > > > > > > > > > Thanks, > > > > JRB > > > > > > > > jeremy brand <jeremy@nirvani.net> wrote: > > > > > > > > > > > I want to use PHP to create some POST vars and post to a given > > page > > > > > > with the browser going to that page. I've seen some posts here > > > > (like > > > > > > Rasmus' post) and a code snippet on Zend that use fsockopen() > > and > > > > > > fputs() to post some variables to a page, but the browser never > > > > > > actually goes to the receiving page. Unless I've used them > > > > wrong... > > > > > > > > > > > > What I want is the browser to act as if the the user had > > actually > > > > > > posted the form himself. > > > > > > > > > > > > Anyone know how I can do this? > > > > > > > > > > Simulate your post, like the code you describe as having, with > > > > > fsockopen, then send a header('Location: > > > > > http://somewhere') to > > the > > > > > page at which you want to end up. > > > > > > > > > > -jeremy brand -- ls