Form action help

[Duckface]

action="<?php echo htmlspecialchars($_SERVER["PHP_SELF"]);?>

I require that on the form method, although I'm aware that vbulletin requires the variable name for the action method.

E.g:

<form name="upgrade" method="POST" action="{vb:raw _SERVER.PHP_SELF}">

So how can I have that in the variable format?

[kh99]

Does that not work? Or is it the htmlspecialchars() that you're wondering about? I think if you use vb:var instead of vb:raw it does htmlspecialchars() on the value.

[Duckface]

It's this page you see:

http://spawnscape614.co.uk/forums/reportuser.php?

And I'm trying to validate the first input for a test. And when clicking the send report button it simply reloads...
Appropriate html:
<form class="vbform block" action="{vb:raw _SERVER.PHP_SELF}">
<label for="username">Enter offender's name: </label>
<input type="text" class="primary textbox" id="name" name="username" tabindex="1" /></input><span class="error"> * <?php echo $usernameErr;?></span>
<input type="submit" class="button" value="Send Report" tabindex="1" />
</form>


Appropriate php:

$usernameErr = "";
$username = "";
if(isset($_POST['submit'])) {
if (empty($_POST["name"])) {
$nameErr = "Name is required";
} else {
$name = test_input($_POST["name"]);
}

}

function test_input($data) {
$data = trim($data);
$data = stripslashes($data);
$data = htmlspecialchars($data);
return $data;
}


--------------- Added 1435933147 at 1435933147 ---------------

Idk why it just reloads. And I tried the var instead of the raw and it didn't work.

[Duckface]

Could anyone up?

[kh99]

Sorry, I missed your response.

OK, I had to do a little test to figure these things out, but first you need method="POST" in your form tag. Second, the indexes into $_POST are the name attributes of the input fields, so if you want to check for submit, you want to add name="submit" to that tag like:
<input name="submit" type="submit" class="button" // etc


If you don't have a name attribute, the input will not go into the $_POST array at all.

You also want to use 'username' when checking the name, since that's the value of the name attribute.

[Duckface]

Hmm it's still not working. Do you have skype? I'll pay for your assistance btw.

[kh99]

I can't really do that right now, but here's the test program I used. I just put it in a file called test.php and pointed my browser there. It's not a vbulltin file at all, just a simple php file.

<form method="POST" class="vbform block" action="<?php echo $_SERVER['PHP_SELF']; ?>">
<label for="username">Enter offender's name: </label>
<input type="text" class="primary textbox" id="name" name="username" tabindex="1" /></input><span class="error"> * </span>
<input name="submit" type="submit" class="button" value="Send Report" tabindex="1" />

</form>
<br/><br/>
<?php

if (array($_POST) && count($_POST))
{
var_dump($_POST);
}
else
echo '$_POST empty';
?>

[Duckface]

Yes, what I put worked on a page without vbulletin; although it doesn't work inside a vbulletin page.

[kh99]

Oh, OK. Did you try this for the code:
$usernameErr = "";
$username = "";
if(isset($_POST['submit'])) {
if (empty($_POST["username"])) {
$nameErr = "Name is required";
} else {
$name = test_input($_POST["username"]);
}

}

function test_input($data) {
$data = trim($data);
$data = stripslashes($data);
$data = htmlspecialchars($data);
return $data;
}


and you said you added name="submit" to the submit button, right?

It's hard to tell if that's everything you need without seeing the big picture. Where are you putting that code, if that a plugin, or is reportuser.php a custom script? (I guess it's not a vbuletin file so that's probably it).

[Duckface]

It's a basic custom file.

Here is the page:

http://spawnscape614.co.uk/forums/reportuser.php

It's not a plugin either. Would you like the entire template?

[kh99]

Well, it's probably more about the code. What does it do now, does it still just reload?

It looks like right now you have method="get", but I see the other line commented out, so maybe you're just doing that to test? Also the submit button has styler=" (with just one quote), again maybe just something you're testing? I think that's stopping it from submitting because it's combining with the type=" that follows. But that means that it's not getting set to type="submit".

Otherwise that looks OK, so I guess if it's reloading it would be an issue with the script.

[Duckface]

Wait I think I know what it is:


<div class="blockrow">
<label for="username">Enter offender's name: </label>
<input type="text" class="primary textbox" id="name" name="username" tabindex="1" /></input><span class="error">*<?php echo $usernameErr; ?></span>
</div>

Specifically:

<span class="error">*<?php echo $usernameErr; ?></span>

Will that php word on a vbulletin page or will it need a variable ?

I'm using the get method because on the post method it redirects me with this:

https://vborg.vbsupport.ru/

[kh99]

Wait I think I know what it is:


<div class="blockrow">
<label for="username">Enter offender's name: </label>
<input type="text" class="primary textbox" id="name" name="username" tabindex="1" /></input><span class="error">*<?php echo $usernameErr; ?></span>
</div>

Specifically:

<span class="error">*<?php echo $usernameErr; ?></span>

Will that php word on a vbulletin page or will it need a variable ?

Yeah, you need to use a variable. If it's a global then {vb:raw GLOBALS.usernameErr} might work (although it's kind of cheating), otherwise you need to register it to the template.

I'm using the get method because on the post method it redirects me with this:

http://i.prntscr.com/12788d95576f4b0c817ce12ff3425809.png

I'm not sure what's doing that, but you could try adding this in your form:
<input type="hidden" name="s" value="{vb:raw session.sessionhash}" />
<input type="hidden" name="securitytoken" value="{vb:raw bbuserinfo.securitytoken}" />


You *could* use GET, but everything will be on the url, and you'd need to check $_GET instead of $_POST. You can check $_REQUEST to get either one, but it's probably better to use the one that your form is using unless you have a reason to do otherwise. (Sorry if you already know all that - you probably know more than I do when it comes to non-vbulletin php).