I recently asked this question Posting data with curl - actually refreshing to the next page but I soon realized that the solution wasn't exactly great...
So I'm passing data between PHP pages in several places. Here's my current problem:
I rely on cookies so I check at the top of each page if cookies have been enabled:
session_start();
if (!isset($_COOKIE['PHPSESSID'])) {
if ($_GET['rd'] == '1') {
header('Location: *redirect url*');
} else {
*refresh the page, setting 'rd' to '1'*
}
}
However, since this is a 'header' on each page, it needs to be generic. For example, any post or get data sent to it (from another page, or a form) should be sent to the redirected page.
Get is easy because I can include it in the url, but I've been having problems with Post.
I started with cURL to send Post data to the next page, but I realized that it wasn't actually going to the page
$ch = curl_init($some_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, 'myvar=something');
curl_exec($ch);
curl_close($ch);$ch = curl_init($some_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, 'myvar=something');
curl_exec($ch);
curl_close($ch);
cURL doesn't load $url afterwards; it returns it
So I was advised to use Sessions, and I soon realized that it wasn't such a great solution;
In regard to number 2, I set another session variable to tell the following page if the Post data has been moved to Session. However, each time I have to reset that variable, and it just makes things complicated and untidy.
The Example: I have a registration page that sends the form data to the validation page. Both of these has the header to check if cookies are enabled.
Post data is sent to the validation page, and if there is a problem, I can't post data back to the validation page (telling the user what were the problems), I've got to set a session variable with the registration errors. And each time, I've got to unset the registration errors variable.
Right now I don't think I need cookies on the validation page, but I don't want any loopholes and I don't know what I will add later.
Back to the problem
I know it's a big task, but if anyone could help it'd be greatly appreciated!
If all the intermediary page is doing is validating form data, scrap it; just do it in the same PHP script. At the simplest, you can have:
<?php
$yourkey = 'goeshere';
if (!isset($_COOKIE[$yourkey])) {
setcookie($yourkey, $value, $expires);
}
if (isset($_POST['submit'])) {
$errors = array();
// do validation here
// iterate over your fields and add any errors to $errors array
if (empty($errors)) {
// redirect if there are no errors, if you really need to
header('Location: success.php');
exit;
}
}
?>
<html>
<body>
<form method="post" action="">
<label for="name">Your name:</label>
<input type="text" name="name" value="<?php echo isset($_POST['name']) ? $_POST['name'] : ''; ?>" id="name" />
<input type="submit" name="submit" value="Submit" />
</form>
</body>
</html>
There is an XSS vulnerability echoing POST data in your HTML page, but I'll leave that up to you to secure.
I'm not sure if this is helpful, but maybe you can try to limit the amount of pages? What I usually do, is have the form ánd the validation on one php page. You check if a user send something at the start, if he did, check it and show any errors. If not, show the form.