Need expert help with advanced form Submit question

Need expert help with advanced form Submit question

am 19.10.2007 07:01:13 von SaraLeePerson

Hello, could someone please kindly show me how to do this? I am
running some experiments with this and hope to see if it can work
again.

Basically, I need a simple form page that will submit its results to
the same page. I've seen this done before, but cannot recreate the
results.

Something like,






So basically I want to prove hitting the form submit button sends me
to the same page it is on, and passes some result back to it, and I
can take it from there. Can this be done? :)

Thank you in advance for help. Sara

Re: Need expert help with advanced form Submit question

am 19.10.2007 09:48:45 von John

wrote in message
news:1192770073.064802.86470@e34g2000pro.googlegroups.com...
> Hello, could someone please kindly show me how to do this? I am
> running some experiments with this and hope to see if it can work
> again.
>
> Basically, I need a simple form page that will submit its results to
> the same page. I've seen this done before, but cannot recreate the
> results.
>
> Something like,
>
>


>
>
>

>
> So basically I want to prove hitting the form submit button sends me
> to the same page it is on, and passes some result back to it, and I
> can take it from there. Can this be done? :)
>
> Thank you in advance for help. Sara
>

I cannot see how this can be done in HTML. It is straightforward in Perl.
Indeed, Perl Web programmers do it all the time.

action='/example.com/cgi-bin/test.pl'
use CGI;
my $testdata=param('test_Data');
[ work on variable $testdata ]

Have you seen something like this?

Regards
John

Re: Need expert help with advanced form Submit question

am 19.10.2007 09:49:19 von nigel_moss

While the city slept, SaraLeePerson@gmail.com (SaraLeePerson@gmail.com)
feverishly typed...

[...]
>


>
>
>

>
> So basically I want to prove hitting the form submit button sends me
> to the same page it is on, and passes some result back to it, and I
> can take it from there. Can this be done? :)

Assuming you have PHP on your server, try something like the following;

">
(rest of form...)


and anywhere else on your page...

if(isset($_POST["test_Data"])) {
print("

test_Data = ".$_POST["test_Data"]."

\n");
}
?>

Hope that helps.

Cheers,
Nige


--
Nigel Moss http://www.nigenet.org.uk
Mail address will bounce. nigel@DOG.nigenet.org.uk | Take the DOG. out!
"Your mother ate my dog!", "Not all of him!"

Re: Need expert help with advanced form Submit question

am 19.10.2007 09:55:00 von CF

let it be known on Fri, 19 Oct 2007 05:01:13 -0000
SaraLeePerson@gmail.com scribed:

|Hello, could someone please kindly show me how to do this? I am
|running some experiments with this and hope to see if it can work
|again.
|
|Basically, I need a simple form page that will submit its results to
|the same page. I've seen this done before, but cannot recreate the
|results.
|
|Something like,
|
|


|
|
|

|
|So basically I want to prove hitting the form submit button sends me
|to the same page it is on, and passes some result back to it, and I
|can take it from there. Can this be done? :)
|
|Thank you in advance for help. Sara
|

My contact form here

does everything on the contact.asp, including the error page and sending the message to me (JMail on the server).

It's done in plan old .asp so a lot will depend what you have available on your server. I just capture the status=submit to have the page display the conformation.

hth
--
cf
I may be dumb, but I'm not stupid.
Terry Bradshaw

Re: Need expert help with advanced form Submit question

am 19.10.2007 10:18:45 von Neredbojias

Well bust mah britches and call me cheeky, on Fri, 19 Oct 2007 05:01:13 GMT
scribed:

> Hello, could someone please kindly show me how to do this? I am
> running some experiments with this and hope to see if it can work
> again.
>
> Basically, I need a simple form page that will submit its results to
> the same page. I've seen this done before, but cannot recreate the
> results.
>
> Something like,
>
>


>
>
>

>
> So basically I want to prove hitting the form submit button sends me
> to the same page it is on, and passes some result back to it, and I
> can take it from there. Can this be done? :)

Of course it can be doen - simply by setting the action parameter to the
url of the source page.

What you do with the data, however, will depend upon the scripting type you
opt to utilize. And you will need some scripting. My recommendation is to
look into php.

--
Neredbojias

Re: Need expert help with advanced form Submit question

am 19.10.2007 14:26:41 von Bergamot

SaraLeePerson@gmail.com wrote:
>
> So basically I want to prove hitting the form submit button sends me
> to the same page it is on, and passes some result back to it, and I
> can take it from there. Can this be done?

Not in HTML, but any server-side language will do it.

--
Berg

Re: Need expert help with advanced form Submit question

am 19.10.2007 16:26:41 von lws4art

nice.guy.nige wrote:
> While the city slept, SaraLeePerson@gmail.com (SaraLeePerson@gmail.com)
> feverishly typed...
>
> [...]
>>


>>
>>
>>

>>
>> So basically I want to prove hitting the form submit button sends me
>> to the same page it is on, and passes some result back to it, and I
>> can take it from there. Can this be done? :)
>
> Assuming you have PHP on your server, try something like the following;
>
>
">
> (rest of form...)
>


I feel compelled to warn you all that you should *not* do the above
example. There is an XSS flaw in it. A safe example to demonstrate the
risk is to pass this to the example script:

http://example.com/risky.php/%22%3E%3Cscript%3Ealert('xss, time to be
worried')%3C/script%3E%3Cfoo

You will get a harmless alert box, but there are a lot more nefarious
things that can be done. There is an easy fix though, don't use the raw
URL parsed by $_SERVER["PHP_SELF"].

sanitized=htmlentities($_SERVER['PHP_SELF']); // prevent XSS insertion

Then use:






--
Take care,

Jonathan
-------------------
LITTLE WORKS STUDIO
http://www.LittleWorksStudio.com

Re: Need expert help with advanced form Submit question

am 19.10.2007 20:29:58 von BootNic

"Jonathan N. Little" wrote:
news:46b3f$4718be9b$40cba7cb$16012@NAXS.COM:

>> ">
>> (rest of form...)
>>
>
> I feel compelled to warn you all that you should *not* do the above
> example. There is an XSS flaw in it. A safe example to demonstrate the
> risk is to pass this to the example script:
>
> http://example.com/risky.php/%22%3E%3Cscript%3Ealert('xss, time to be
> worried')%3C/script%3E%3Cfoo
>
> You will get a harmless alert box, but there are a lot more nefarious
> things that can be done. There is an easy fix though, don't use the
> raw URL parsed by $_SERVER["PHP_SELF"].
>
> sanitized=htmlentities($_SERVER['PHP_SELF']); // prevent XSS insertion
>
> Then use:
>
>



$_SERVER["SCRIPT_NAME"] may be an alternative.

--
BootNic Friday October 19, 2007 2:29 PM
The world is very different now. For man holds in his mortal hands
the power to abolish all forms of human poverty, and all forms of
human life.
*John Fitzgerald Kennedy, Inaugural Address*

Re: Need expert help with advanced form Submit question

am 19.10.2007 21:44:55 von lws4art

BootNic wrote:
> "Jonathan N. Little" wrote:
> news:46b3f$4718be9b$40cba7cb$16012@NAXS.COM:
>
>>> ">
>>> (rest of form...)
>>>
>> I feel compelled to warn you all that you should *not* do the above
>> example. There is an XSS flaw in it. A safe example to demonstrate the
>> risk is to pass this to the example script:
>>
>> http://example.com/risky.php/%22%3E%3Cscript%3Ealert('xss, time to be
>> worried')%3C/script%3E%3Cfoo
>>
>> You will get a harmless alert box, but there are a lot more nefarious
>> things that can be done. There is an easy fix though, don't use the
>> raw URL parsed by $_SERVER["PHP_SELF"].
>>
>> sanitized=htmlentities($_SERVER['PHP_SELF']); // prevent XSS insertion
>>
>> Then use:
>>
>>


>
> $_SERVER["SCRIPT_NAME"] may be an alternative.
>

Yes, but you would lose and legitimate query string parameters if this
was a GET process.

--
Take care,

Jonathan
-------------------
LITTLE WORKS STUDIO
http://www.LittleWorksStudio.com

Re: Need expert help with advanced form Submit question

am 20.10.2007 00:46:43 von BootNic

"Jonathan N. Little" wrote:
news:b7604$47190931$40cba7cb$32210@NAXS.COM:

> BootNic wrote:
>> "Jonathan N. Little" wrote:
>> news:46b3f$4718be9b$40cba7cb$16012@NAXS.COM:
>>
>>>> ">
>>>> (rest of form...)
>>> I feel compelled to warn you all that you should *not* do the above
>>> example. There is an XSS flaw in it. A safe example to demonstrate
>>> the risk is to pass this to the example script:
>>>
>>> http://example.com/risky.php/%22%3E%3Cscript%3Ealert('xss, time to
>>> be worried')%3C/script%3E%3Cfoo
>>>
>>> You will get a harmless alert box, but there are a lot more
>>> nefarious things that can be done. There is an easy fix though,
>>> don't use the raw URL parsed by $_SERVER["PHP_SELF"].
>>>
>>> sanitized=htmlentities($_SERVER['PHP_SELF']); // prevent XSS
>>> insertion
>>>
>>> Then use:
>>>
>>>


>>
>> $_SERVER["SCRIPT_NAME"] may be an alternative.
>>
>
> Yes, but you would lose and legitimate query string parameters if this
> was a GET process.

Where would it go?

$_GET perhaps

--
BootNic Friday October 19, 2007 6:46 PM
Inform all the troops that communications have completely broken
down.
*Ashleigh Brilliant*

Re: Need expert help with advanced form Submit question

am 20.10.2007 05:50:45 von lws4art

BootNic wrote:
> "Jonathan N. Little" wrote:
> news:b7604$47190931$40cba7cb$32210@NAXS.COM:
>
>> BootNic wrote:
>>> "Jonathan N. Little" wrote:
>>> news:46b3f$4718be9b$40cba7cb$16012@NAXS.COM:

>>>>
>>> $_SERVER["SCRIPT_NAME"] may be an alternative.
>>>
>> Yes, but you would lose and legitimate query string parameters if this
>> was a GET process.
>
> Where would it go?
>
> $_GET perhaps
>

Duh! Of course. $_SERVER["SCRIPT_NAME"] also insures trailing characters
are not parsed and removes that method of XSS. Also if the server has
magic quotes enabled helps.


--
Take care,

Jonathan
-------------------
LITTLE WORKS STUDIO
http://www.LittleWorksStudio.com