How can I handle data or values within pages

[caracena]

Hi everybody,

I'm in the process of learning how to make a program/plugin for vBulletin and it's pretty darn fun! I begun yesterday and I already know how to make a program with it's own templates and plugins (thanks Lynne and Cellarius) and those pages look great! My problem now is that I don't know what to do with those pages.

For example, I have a template with a form and two text boxes in it asking for 2 numbers and I want to display another page/template with the result of adding those two numbers together (i.e. 2+3=5). Where should my form point to? Another page? same page with an IF clause in the template? Where should the math take place? Should I use GET or POST?

Thanks in advance!

[kh99]

You could point to another page or the same one. I think with the "add two numbers" example you describe I'd probably use one page and use the input form data to initialize the input text fields (or leave them blank if the input isn't set, like the first time you go to the page), and then check to see if both input variables are set to numbers, and if so display the answer.

As far as GET vs POST, both with will work. I had never really thought about it much until you asked, so I searched and found this answer: http://stackoverflow.com/questions/4...do-you-use-get

[caracena]

All right, thanks for your answer. My question about using POST or GET was aimed toghuards security. I would like to learn to do this "the right way" from the start instead of later having to correct "old habits".

I'm just realizing that I will always have to check if it's a user or a guest who's using the product (passing the arguments) and whether that user is in a group that is allowed to do it. Is there some easy way of doing this? Maybe something integrated into vBulletin's core?

I don't want to make a mod that will enable anybody to type /somepage.php?action=delete&what=someid and get away with it but I also hate the idea of making a mod that will add a million queries to each page load.

Thanks again!

[kh99]

Originally Posted by caracena

All right, thanks for your answer. My question about using POST or GET was aimed toghuards security. I would like to learn to do this "the right way" from the start instead of later having to correct "old habits".

I don't think it makes any difference from a security standpoint. It might seem like POST is more secure because you don't see the data, but it's really not. I think that answer I linked to above talks about the safety of not being able to just go to a url and have it do something dangerous, but I guess another way to look at it is that if it's not useful to allow it to be specified on the url then you might as well use POST. As for security, no matter how the input comes, you have to be careful what you do with it.

vbulletin has a gpc_clean() function that takes values from any one of or all three of GET, POST, and cookie data and puts them in the array $vbulletin->GPC[]. If you specify 'r' as the first param it gets a value from any of the three, so if you use that it doesn't matter if you use GET or POST (or use both in different situations). You shouldn't have any trouble finding examples of that in the vb code.

I'm just realizing that I will always have to check if it's a user or a guest who's using the product (passing the arguments) and whether that user is in a group that is allowed to do it. Is there some easy way of doing this? Maybe something integrated into vBulletin's core?

I assume you've used one of those "make your own vbulletin page" articles, so including global.php will make your page check if a user is logged in and load their info. So you can check $vbulletin->userinfo[userid] and it will be their user id or else 0 if they're not logged in. You can check for the user being a member of one or a set of groups using is_member_of($vbulletin->userinfo, 1, 2, 3), which will be true if the user is a member of either group 1, 2, or 3 (you can specify one or more group ids, I just put three as an example).

What I mentioned above is what you'd use in php code. You can also do it from template conditionals like <vb:if condition="$bbuserinfo[userid] != 0"> or <vb:if condition="is_member_of($bbuserinfo, 1, 2, 3)">.