PHP / HTML problem - Dotable

waldo · 11th March 2008, 05:46 AM

Hey all,

I've been banging my head off a brick-wall for the last hour or so; I'm running through some PHP code to create a custom HTML form (depending on records in database). The form itself acts as a sign-up for sessions / classes. Certain sessions require all classes to be taken whereas other sessions have classes where the user can pick or choose.

On form submission, I was having difficulties processing the data. In the instance where sessions required all classes to be taken, I was showing the checkboxes but with both DISABLED and CHECKED properties. I've now realised that even with CHECKED being supplied, the checkbox is ignored (I'm guessing due to DISABLED)

Anyone know a way around this? I obviously don't want to have the checkbox user-alterable as... well, some users will uncheck 'em! Hope someone has expertise in this area

Cheers,
andy

foobic · 11th March 2008, 08:54 AM

So a checkbox that's checked and disabled doesn't show up in the form submission? I never noticed that before. How strange...

Still, since you can't trust user input anyway, you really need to use the same logic in form processing / validation as you did for form generation - ie. if the session requires all classes to be taken (and the form has these checked and disabled) then you can safely ignore the lack of user input and set all true.

Alternatively you could just change the form generation so for checked and disabled it displays a dummy checkbox under a different name and a hidden field in the name you want. You'd still need validation as above anyway.

HTH

Ricardo · 12th March 2008, 01:29 PM

When a form element is disabled it will not be submited with the form. If you want it disabled by default, then handcode its value in your response script.

If you need to script this checkbox behaviour and don't want your user to interact directly, use a hidden field to accept the values this script will set before your user submit the form.

waldo · 14th March 2008, 08:18 AM

I think I'll go down the hidden field route so that, even if a user does uncheck a check box, the correct response will still be taken (beats extraneous coding in the submission / validation stage of the code).

Thanks for the replies

foobic · 14th March 2008, 09:32 AM

I wouldn't ever call server-side validation "extraneous coding". There's a simple principle here: trust nothing you get from the user.

Hidden fields can be changed too - not quite as easily as clicking a checkbox but it's not hard to do.

Ricardo · 14th March 2008, 11:16 AM

If you know the variable will not be changed, then you do not even need to use a hidden field, because there is no meaning in sending to the server this fixed information. Then, just use the checkbox as a visual clue for the user. And if the checkbox is disabled, the user will not be able to uncheck it.

I do agree with foobic, validation is never extraneous. It is absolutely necessary.

11th March 2008, 05:46 AM	#1 (permalink)
waldo Cross Hare Join Date: Jul 2006 Location: Scotland Posts: 441	PHP / HTML problem Hey all, I've been banging my head off a brick-wall for the last hour or so; I'm running through some PHP code to create a custom HTML form (depending on records in database). The form itself acts as a sign-up for sessions / classes. Certain sessions require all classes to be taken whereas other sessions have classes where the user can pick or choose. On form submission, I was having difficulties processing the data. In the instance where sessions required all classes to be taken, I was showing the checkboxes but with both DISABLED and CHECKED properties. I've now realised that even with CHECKED being supplied, the checkbox is ignored (I'm guessing due to DISABLED) Anyone know a way around this? I obviously don't want to have the checkbox user-alterable as... well, some users will uncheck 'em! Hope someone has expertise in this area Cheers, andy

11th March 2008, 08:54 AM	#2 (permalink)
foobic Member Join Date: Jun 2006 Posts: 61	So a checkbox that's checked and disabled doesn't show up in the form submission? I never noticed that before. How strange... Still, since you can't trust user input anyway, you really need to use the same logic in form processing / validation as you did for form generation - ie. if the session requires all classes to be taken (and the form has these checked and disabled) then you can safely ignore the lack of user input and set all true. Alternatively you could just change the form generation so for checked and disabled it displays a dummy checkbox under a different name and a hidden field in the name you want. You'd still need validation as above anyway. HTH __________________ Chris :: ClonePanel: Open source backup \| monitoring \| dns failover for resellers.

12th March 2008, 01:29 PM	#3 (permalink)
Ricardo New Dotable member Join Date: Feb 2006 Location: Brazil Posts: 8	Disable means "do not submit" When a form element is disabled it will not be submited with the form. If you want it disabled by default, then handcode its value in your response script. If you need to script this checkbox behaviour and don't want your user to interact directly, use a hidden field to accept the values this script will set before your user submit the form.

14th March 2008, 09:32 AM	#5 (permalink)
foobic Member Join Date: Jun 2006 Posts: 61	I wouldn't ever call server-side validation "extraneous coding". There's a simple principle here: trust nothing you get from the user. Hidden fields can be changed too - not quite as easily as clicking a checkbox but it's not hard to do. __________________ Chris :: ClonePanel: Open source backup \| monitoring \| dns failover for resellers.

Thread Tools	Search this Thread
Show Printable Version Email this Page	Search this Thread: Advanced Search
Display Modes
Linear Mode Switch to Hybrid Mode Switch to Threaded Mode

14th March 2008, 08:18 AM	#4 (permalink)
waldo Cross Hare Join Date: Jul 2006 Location: Scotland Posts: 441	I think I'll go down the hidden field route so that, even if a user does uncheck a check box, the correct response will still be taken (beats extraneous coding in the submission / validation stage of the code). Thanks for the replies

14th March 2008, 11:16 AM	#6 (permalink)
Ricardo New Dotable member Join Date: Feb 2006 Location: Brazil Posts: 8	If you know the variable will not be changed, then you do not even need to use a hidden field, because there is no meaning in sending to the server this fixed information. Then, just use the checkbox as a visual clue for the user. And if the checkbox is disabled, the user will not be able to uncheck it. I do agree with foobic, validation is never extraneous. It is absolutely necessary.