php update and continue button

[anonymous]

Hey!

Im trying to use an update and continue button on a form without any javascript.

so first just like a shopping cart where user update their cart so they can see the totals and then continue.

the problem is that the update and continue button are both type=submit and are on the same form which goto the same action=

i want it without any javascript, heres the example below.


so below, i want customer to be able to select quatities and then be able to update cart to calculate totals just by php then after they see the total they can click continue.

<form action="./signup.php?plan &payments" method="post">

<select name="qauntity1 ">
<option value='4'>4</option>
<option value='5'>5</option>
<option value='6'>6</option>
<option value='7'>7</option>
</select>

<input type="text" name="amount1" readonly><br><b r>

<select name="qauntity1 ">
<option value='4'>4</option>
<option value='5'>5</option>
<option value='6'>6</option>
<option value='7'>7</option>
</select>

<input type="text" name="amount2" readonly><br>

Total: $<input type="text" name="total" id="total" readonly><br>

<input type="submit" name="submit" value="Update"> <input type="submit" name="submit" value="Continue ">

</form>

[gregerly]

I was having a similar issue recently on a shopping cart I built. What you need to do, is check to see which submit was clicked. Both buttons should be input type=submit, but they should have different values. If you click the "Update" button, only the update button is available in the POST array submitted with the form, the "continue" button isn't submitted unless it's clicked on. Then in your PHP you could have something like:

[PHP]switch($_POST['submit']){
case "update":
//handle the update code
break;
case "submit":
//handle the submit code
break;
}[/PHP]

[anonymous]

I was having a similar issue recently on a shopping cart I built. What you need to do, is check to see which submit was clicked. Both buttons should be input type=submit, but they should have different values. If you click the "Update" button, only the update button is available in the POST array submitted with the form, the "continue" button isn't submitted unless it's clicked on. Then in your PHP you could have something like:

[PHP]switch($_POST['submit']){
case "update":
//handle the update code
break;
case "submit":
//handle the submit code
break;
}[/PHP]

thanks, but does it have to be $_POST[]
because i like using $_REQUEST[]

[Atli]

thanks, but does it have to be $_POST[]
because i like using $_REQUEST[]

That is not a good idea, from a security standpoint. It may be a little less effort on you part, but it can be a serious security issue.

I mean, lets say you had a page to process orders in your shopping chart that accepted values from a form using POST data. Now if you use $_REQUEST, anybody could just type up the order in the query string and your script would just accept it as a valid data.

As for your continue.. update problem.
Have you considered putting the buttons in seperate forms?

[kovik]

Technically, REQUEST isn't any more secure than POST or GET. There is no real security risk in using REQUEST.

You just have to be aware that REQUEST consists of GET, POST, SESSION, and COOKIE, usually in that order. This means that they can overwrite each other. So if there is a session or cookie variable by the same name (i.e. a login form that uses a field named 'username,' and there's a session variable or cookie variable named 'username' as well), then your script will accept the value from the session / cookie over the GET / POST requests.

Like Atli said, it can accept GET data as well POST data for the same value, but that's not a 'security' risk. It does make it possible for a clueless user to click a link that posts data that they do not want to, however, and makes it easy for data to be re-posted over and over again by following the same URL. These are both unexpected results that could be remedied a bit easier if you used the proper data.

There *is* an actual security risk in REQUEST, though. It can open you up to XSS through the URL. However, if you treated REQUEST the same way you're supposed to treat GET or POST, then you wouldn't be vulnerable to it.