Php Submit to self returning source code

Question

I am trying to submit a php form to self but after submit the page returns the source code of the page and not the processed data.

I have a issset to check if the form has been submitted and then have functions on the same page to process the submitted data.

Here is the code:

    if(isset($_POST['submit'])){

        if ($_POST['name' == 'px']) {
            $pxValue = $_POST['value'];
            $value = convertToEm($pxValue); 
        }

        if ($_POST['name' == 'em']) {
            $emValue = $_POST['value'];
            $value = convertToPx($emValue); 
        }

        function convertToEm($value) {
            $base_font = 16;
            $em_value = $value / $base_font;
            return $em_value;

        }
    }

Here is the form:

<form action="" id="converterPx" method="POST">
    <h3>Convert Pixels to Ems:</h3>
    <label>PX:</label>
    <input type="text" name="value" value="" />
    <?php echo 'Result:'. $value; ?>
    <input type="hidden" name="type" value="px" />
    <input type="submit" name="submit" id="submit-px" />
</form>

Trying to get the form processed on the same page

Using the Browser Inspector, i see that the POST is submitted with values.

Any help with this would be great

are you forgetting the `` tags? – Lawrence Cherone Feb 22 '12 at 17:12 — Lawrence Cherone, Feb 22 '12 at 17:12

score 1 · Answer 1 · answered Feb 22 '12 at 17:18

1

If PHP source appears on the returned page it is either because you forgot the tags

Or because of the server not being configured to execute PHP correctly

(Or the file name has the wrong extension)

answered Feb 22 '12 at 17:18

Pete

1,289
10
18

How would one check to see if my server is configured to execute PHP, i did a phpinfo() and it seems to work fine...? – estern Feb 22 '12 at 17:31

Sam Arul Raj T · Accepted Answer · 2012-02-22T18:10:20.147

To make a self action in the same page use this in the form action $_SERVER['REQUEST_URI']

//This is the exact answer code of your question

<?php
if(isset($_POST['submitBtn'])){


    function convertToEm($value) {

            $base_font = 16;
            $px_value = $value/$base_font;
        return  $px_value;
        }
        function convertToPx($value) {
            $base_font = 32;
            $em_value = $value/$base_font;
            return  $em_value;
        }

       if (isset($_POST['type']) && $_POST['type']=='px') {

            $pxValue = $_POST['value'];
        $value = convertToEm($pxValue); 

        }

        if (isset($_POST['type']) && $_POST['type'] == 'em') {

            $emValue = $_POST['value'];
            $value = convertToPx($emValue); 

        }


    }

//form data

<form action="<?php echo $_SERVER['REQUEST_URI']; ?>" id="converterPx" method="POST">
    <h3>Convert Pixels to Ems:</h3>
    <label>PX:</label>
    <input type="text" name="value" />
    <?php echo 'Result:'.$value; ?>
    <input type="hidden" name="type" value="px" />
    <input type="submit" name="submitBtn" id="submit-px" />
</form>

@LawrenceCherone ,,but it is not the proper way of submitting data,,In php standard it should follow some coding styles — Sam Arul Raj T, Feb 22 '12 at 18:13

score 1 · Answer 3 · answered Feb 22 '12 at 17:33

1

This is a typo in your code ,,you used name instead of type

if ($_POST['type']== 'px') {
        $pxValue = $_POST['value'];
        $value = convertToEm($pxValue); 
    }

    if ($_POST['type'] == 'em') {
        $emValue = $_POST['value'];
        $value = convertToPx($emValue); 
    }

answered Feb 22 '12 at 17:33

Sam Arul Raj T

1,752
17
23

@estern Check the recent answer by me , this is what exactly your ask for – Sam Arul Raj T Feb 22 '12 at 18:12

score 0 · Answer 4 · answered Feb 22 '12 at 17:12

0

$_POST['name' == 'px'] should probably be $_POST['name'] == 'px'] (with a similar change being made on the similar construct).

You are trying to use the result of the comparison between two strings (which will be false) as the array index.

answered Feb 22 '12 at 17:12

Quentin

914,110
126
1,211
1,335

Lawrence Cherone · Answer 5 · 2012-02-22T17:21:02.250

Are you forgetting the <?php ?> tags? also $_POST['name' == 'px'] should be $_POST['name'] == 'px', convertToPx function is missing, you have no param called name on your form annnnd your not echoing anything.

<?php if(isset($_POST['submit'])){

        if ($_POST['name']== 'px') {
            $pxValue = $_POST['value'];
            $value = convertToEm($pxValue); 
        }

        if ($_POST['name'] == 'em') {
            $emValue = $_POST['value'];
            $value = convertToPx($emValue); 
        }

        function convertToEm($value) {
            $base_font = 16;
            $em_value = $value / $base_font;
            return $em_value;
        }
        function convertToPx($value) {
            $base_font = 32;
            $em_value = $value / $base_font;
            return $em_value;
        }


    echo $value;
    }
?>

yah i am aware that the function is missing i have only been testing the convertToPx form. Also are you sure there should be a second ] and it shouldn't be: $_POST['name'] == 'px' — estern, Feb 22 '12 at 17:21
I have the PHP tags too just didnt copy them to the code for here — estern, Feb 22 '12 at 17:29

msanford · Answer 6 · 2012-02-22T17:24:58.847

0

You're not submitting to self, you're submitting to nothing:

<form action="" id="converterPx" method="POST">

Edit: As Lawrence has pointed out, one should avoid using the method I originally described below. Instead, use $_SERVER['SCRIPT_NAME']; and for more information, see http://www.webadminblog.com/index.php/2010/02/23/a-xss-vulnerability-in-almost-every-php-form-ive-ever-written/

Original: Depending on how you call the form, you can try:

<form action="<?php echo $_SERVER['PHP_SELF'] ?>" id="converterPx" method="POST">

More details here: http://www.html-form-guide.com/php-form/php-form-action-self.html

edited Feb 22 '12 at 17:24

answered Feb 22 '12 at 17:16

msanford

11,803
11
66
93

when i do this i get the url with this appended to it: %3C?php%20echo%20$_SERVER%5B'PHP_SELF'%5D%20?%3E – estern Feb 22 '12 at 17:19
you should NEVER use `` within a form, this will enable XSS and XSRF better to just use `action=""` if posting to self... – Lawrence Cherone Feb 22 '12 at 17:21
Is your form generated by the same script that does the processing? – msanford Feb 22 '12 at 17:22
@LawrenceCherone Fair enough (others, see http://www.webadminblog.com/index.php/2010/02/23/a-xss-vulnerability-in-almost-every-php-form-ive-ever-written/) but the point was that the `action=""` was blank. – msanford Feb 22 '12 at 17:23
by generate, it is just an html form in a php file that has the same processing function yes. – estern Feb 22 '12 at 17:24
@msanford if `action=""` is blank it will post to its self – Lawrence Cherone Feb 22 '12 at 17:25
i dont need to worry about XSS an XSRF, wont be a public site – estern Feb 22 '12 at 17:25
at first i had action="" and that is how i get the form to return just the source code – estern Feb 22 '12 at 17:26
I learned something new today, I didn't realize that `action=""` was valid. Checked it out, and it is http://stackoverflow.com/questions/1131781/blank-html-form-action-posting-back-to-self (Sorry, I know that doesn't help you. Maybe I'll come up with a brilliant idea for why your script is escaping itself over lunch.) – msanford Feb 22 '12 at 17:51

Php Submit to self returning source code

6 Answers6