redirect if form was posted on different site?

[helraizer]

Hi folks,

 

I am trying to let people add comments for their shoutbox, hosted on my site, from their own site. If I do it with a simple form as soon as they post they'll be taken to my site, which may annoy some people. How would I make it that if they post a comment on any site but my own, the comment is still added but they are redirected back to the site they posted from?

 

Should I use sessions; set a session when they post on my page but when they post from theirs, don't, that way could I use this?

 

<?php
if(isset($_POST['submit']) && !isset($_SESSION['post'])) { 
// process post then redirect.
} else {
// process post, stay on page.
} 
?>

 

How would I redirect the user to the page they were just on? I could use javascript:history.back(-1) but if they don't have javascript, that wouldn't work... Is there another way?

 

Sam

 

 

[lordfrikk]

You could use redirect on your own site, which is not a nice solution to the problem. Nice solution is to create a POST request:

 

function PostRequest($url, $referer, $_data) {

    // convert variables array to string:
    $data = array();    
    while(list($n,$v) = each($_data)){
        $data[] = "$n=$v";
    }    
    $data = implode('&', $data);
    // format --> test1=a&test2=b etc.

    // parse the given URL
    $url = parse_url($url);
    if ($url['scheme'] != 'http') { 
        die('Only HTTP request are supported !');
    }

    // extract host and path:
    $host = $url['host'];
    $path = $url['path'];

    // open a socket connection on port 80
    $fp = fsockopen($host, 80);

    // send the request headers:
    fputs($fp, "POST $path HTTP/1.1\r\n");
    fputs($fp, "Host: $host\r\n");
    fputs($fp, "Referer: $referer\r\n");
    fputs($fp, "Content-type: application/x-www-form-urlencoded\r\n");
    fputs($fp, "Content-length: ". strlen($data) ."\r\n");
    fputs($fp, "Connection: close\r\n\r\n");
    fputs($fp, $data);

    $result = ''; 
    while(!feof($fp)) {
        // receive the results of the request
        $result .= fgets($fp, 128);
    }

    // close the socket connection:
    fclose($fp);

    // split the result header from the content
    $result = explode("\r\n\r\n", $result, 2);

    $header = isset($result[0]) ? $result[0] : '';
    $content = isset($result[1]) ? $result[1] : '';

    // return as array:
    return array($header, $content);
}



/*
** The example:
*/

// submit these variables to the server:
$data = array(
    'test' => 'foobar',
    'okay' => 'yes',
    'number' => 2
);

// send a request to example.com (referer = jonasjohn.de)
list($header, $content) = PostRequest(
    "http://www.example.com/",
    "http://www.jonasjohn.de/",
    $data
);

// print the result of the whole request:
print $content;

// print $header; --> prints the headers

 

Source:

http://www.jonasjohn.de/snippets/php/post-request.htm

[soycharliente]

Why is that better than doing something like:

 

$refer = $_SERVER['HTTP_REFER'];
header("Location: $refer");
exit();

[lordfrikk]

If you do POST request from another website to your website it won't redirect, so that's why it's better than redirect -> you don't have to use one.

 

EDIT

 

Why is that better than doing something like:

 

$refer = $_SERVER['HTTP_REFER'];
header("Location: $refer");
exit();

 

Also this won't work if user has sending referer turned off, which is pretty common these days.

[discomatt]

My guess is you want other sites to be able to include their own forms? My suggestion is to make an 'API' of sorts.

 

Inform the owner of the site to include a hidden field named 'redirect'

 

<input type="hidden" name="redirect" value="http://theirsite.com/page/to/redirect/to.html" />

 

Then in your page include this code

 

<?php

// Do all form parsing here

if ($_POST['redirect']) {

   header('Location: ' . urlencode($_POST['redirect']));

// Watch out for header injection here... From what i've read urlencode will help prevent that, as well as using
// php >= 4.4.2 | 5.1.2 where header will only send one header at a time

}

?>

[lordfrikk]

You could it that way, DiscoMatt, but I still don't see why would you use redirect instead of direct POST request.

[helraizer]

Thanks, lordfrikk. I will work on that solution.

 

Sam

[lordfrikk]

Thanks, lordfrikk. I will work on that solution.

 

Sam

 

No problem, Sam, I hope you'll be able to make it work... if not just post here and we'll surely help you out

 

[discomatt]

I was thinking it would be more 'plug and play' for the other site. Say... if it didn't have php running.

[lordfrikk]

^ Nice point there, discomatt. Didn't think of that!