Re: POST action

On 7/28/2013 1:26 PM, Larry Garfield wrote:

On 07/28/2013 12:14 PM, iccsi wrote:

<form action="action.php" method="post"> <p>Your name: <input type="text" name="name" /></p> <p>Your age: <input type="text" name="age" /></p> <p><input type="submit" /></p> </form>In the PHP tutorial manual, it says that we can have post action to the form itself just like above coding.I would like to know in the real projects, can we have action to the same PHP file, since that we only need have one filebut not 2 files foe POST request,Your help and information is great appreciated,regards,Iccsi,

"Real" projects to all kinds of things. Which is best depends on who you ask. :-) I would argue that there's 3 "good" approaches, both of which are viable: 1) Define your form abstractly via an API, and have the API detect the presence of POST request and then process the form after it's built. That means you do submit back to the same URL. (Drupal 7 and earlier do this.) 2) Put 2 separate request handlers / controllers at the same path, one for GET and one for POST. So you submit back to the same URL but an entirely different piece of code responds to it. (This requires a good routing system that can differentiate between GET and POST.) 3) Every form is defined as its own object somewhere with a unique ID. All forms post to the same URL but include the form ID. Code at that URL looks up the form object by ID and maps the submitted data to it to know what to do with it. Note that in all 3 cases you're defining a form via an API of some kind. You are not writing form tags yourself. Don't do that. Ever. I promise you that you will have a security hole or six if you do. Use a good form handling API for building forms. That's what good "Real" projects do. There are a lot out there. Most fullstack frameworks or CMSes have one built in (I know Drupal and Code Ignighter do, although they're quite different), and there are reasonably stand-alone components available in both Symfony2 Components and Zend Framework. Please don't write your own. There are too many good ones (and even more bad ones, of course) already out there that have been security hardened. --Larry Garfield Never write your own form? I'm guilty - oh, so guilty. What exactly is a 'security hardened' form?

IN answer to OP - yes you can use a single script to handle your from return. I do that too! I start by recognizing my first time thru and send out a form/page. I process the submit back from that page, doing something based on the label of the submit button that I detect. I may then do some more processing and produce a newer version of the same form/page and repeat. Or I may end it all at that point. Depends on what the overall appl is doing. And now I'll watch and see how much I'm doing wrong.