Handling form redirects after missing/bad data

[cunoodle2]

I'm just curious how you go about resending the user back to the form to fill it out again when say for example there is a missing element or error message.

 

I WAS doing something like this...

<?php
//if email or either of the passwords are empty it sets the necessairy values to generate an error message
if ($password == NULL || $password2 == NULL || $email == NULL)
{
	$error = "true";
	$error_num = 1;
	header("Location: index.php?error=true&errornum=1");
}

else if ($password != $password2)
{
	$error = "true";
	$error_num = 2;
	header("Location: index.php?error=true&errornum=4");
}
?>

 

Two big issues with my code:

1.  In some cases I have to write other things to the screen which causes the dreaded header error.

2.  I don't like the idea of having something up in the URL as it is very easy for the end user to change it.  I'd prefer to send then back to the form with a bunch of "hidden" values but I don't know that is very easy do considering the user will not actually be clicking on anything.  All of the redirects are as a result of processing the form after it's been submitted.

 

Any help would be appreciated.

[gevans]

Use a session. Store the errors in a session, when the page loads check for the error session, if it's set get all the errors before unsetting it so that it isn't shown again unless you set it.

[cunoodle2]

Aren't there ways to change the values in sessions from the users end?  Like they could could change the values to try to crack into the site?

 

What other methods do people use for form processing?  When there is a missing element in a form or inproperly formatted data do you do something like this..

 

header("Location: index.php?error=true&errornum=1");

 

or something else??

[PFMaBiSmAd]

  Quote

I'm just curious how you go about resending the user back to the form to fill it out again

 

Don't. Make the form and the form processing code the same page. All it takes a a couple of if(){} conditional statements to execute the form processing code or display the form on one page. This also allows you to keep the existing form data in the fields without wasting time redirecting or passing errors or existing form data between pages.