posting forms

When posting a web form, various things can occur that are non-standard or unexpected.

Actually, the first submit-able object on the form is activated. Use scripting to disable the form: add onsubmit=“return false;” to the FORM tag attributes. Then when the user clicks the actual submit button, you use scripting to clear the form onsubmit value, and call form submit(). This way, users who have scripting enabled will have a form that works well by nothing happening when enter is pressed in a form field, and users with scripting disabled will only suffer the problem of having the first submit-able object activated.

Also, be careful checking for the submit array key in $_POST because IE will not send it unless the user actually clicks the submit button, or presses enter on the button. If the user presses enter in a text field, the 'submit' key will not be set in the $_POST array.

To allow a file to be uploaded in a form, you need to add the enctype attribute, and provide a input of type “file”. Remember that php has a limit on the maximum file size that can be uploaded.

<form action="<?=$_SERVER['PHP_SELF']?>" method="POST" enctype="multipart/form-data">
<label>Please specify a file:</label>
<input type="file" name="datafile" size="40">
<input type="submit" value="Send">
</form>

It is common to test for this to determine if a form was posted:

if( $_POST ){
  // do something
}

However, if the only thing in your form was a file input and a submit button, then the post array may be empty. You should test for the files array instead:

if( $_FILES ){
  // do something
}

It is advisable to handle file sizes during uploads. The easiest way to do this is to find out how large the file can be for uploads from apache and/or a php info page. Then you add this element to the form:

<input type="hidden" name="MAX_FILE_SIZE" value="10485760" />

Once the form is posted, you can check for errors like this:

if( $_POST ){
	if( isset($_FILES['datafile']) ){
		if( $_FILES['datafile']['error'] === UPLOAD_ERR_OK ){
			// process the uploaded file
		}else{
			// there was an error
		}
	}
}

You can run a switch/case block if you prefer, and handle each error code differently. See this page for more information about the file upload error codes:

• http://www.php.net/manual/en/features.file-upload.errors.php

To have the selections of a select element become an array when the form is posted, use [] in the variable name.

<select name="items[]" multiple size="3">
  <option value="1">One</option>
  <option value="2">One</option>
  <option value="3">One</option>
</select>

• http://us.php.net/manual/en/reserved.variables.post.php

One feature of PHP's processing of POST and GET variables is that it automatically decodes indexed form variable names.

I've seem innumerable projects that jump through extra & un-needed processing hoops to decode variables when PHP does it all for you:

Example pseudo code:

Many web sites do this:

<form ....>
<input name="person_0_first_name" value="john" />
<input name="person_0_last_name" value="smith" />
...
 
<input name="person_1_first_name" value="jane" />
<input name="person_1_last_name" value="jones" />
</form>

When they could do this:

<form ....>
<input name="person[0][first_name]" value="john" />
<input name="person[0][last_name]" value="smith" />
...
<input name="person[1][first_name]" value="jane" />
<input name="person[1][last_name]" value="jones" />
</form>

With the first example you'd have to do string parsing / regexes to get the correct values out so they can be married with other data in your app… whereas with the second example.. you will end up with something like:

<?php
var_dump($_POST['person']);
//will get you something like:
array (
0 => array('first_name'=>'john','last_name'=>'smith'),
1 => array('first_name'=>'jane','last_name'=>'jones'),
)
?>

This is invaluable when you want to link various posted form data to other hashes on the server side, when you need to store posted data in separate “compartment” arrays or when you want to link your POSTed data into different record handlers in various Frameworks.

Remember also that using [] as in index will cause a sequential numeric array to be created once the data is posted, so sometimes it's better to define your indexes explicitly.