What is the preffered way of checking if a form is submitted in php?

Red Squirrel

No Lifer
May 24, 2003
66,464
11,612
126
I've always put something in my form action like "act=dosubmit" and then in the php code I just check for $_GET['act']=="dosubmit". But you can also just check for isset($_POST['submitbuttonname']) or you can have a hidden field.

Lot of different ways. I even saw some people do if ($_SERVER["REQUEST_METHOD"] == "POST") but that seems very dirty, what if there's more than one form on the same page? Whatever method you use you also want to allow data to be submitted from more than one source, as in your application you may have multiple places where say, you can search for something, so may as well reuse the same form to do that search so you can submit it from another page.

I'm writing a php application and I caught myself being kinda inconsistent in how I'm doing it, and it got me wondering what way is normally preferred?

I'm leaning towards just checking that the submit button is pressed and doing away with the "act" way, but then apparently in IE (because IE is a piece of garbage) if you hit enter instead of clicking the button it won't work. So perhaps a hidden field is better?

In my application I have a form class, so this would be mostly automated as each form has it's own name, so it would just be "[name]submit" or something and not really a big deal to have a hidden field.

Suppose this is just a semantics issue and there's probably not a "right" way, but just curious what people normally do.
 

Red Squirrel

No Lifer
May 24, 2003
66,464
11,612
126
I ended up going with a hidden field. It feels really unconventional, but it saves from needing an extra get variable and also gets around the submit button IE issue. In fact I just implimented it directly as part of my form class so I just need to do if($formobject->IsSubmitted()) to check. It's actually genius now that I think of it and don't know why I didn't do this from the get go.

I need to go cleanup my previous code in this application so I can be consistent now. :p
 

DaveSimmons

Elite Member
Aug 12, 2001
40,730
670
126
Just remember that anyone can use cURL, WinInet, etc. to "submit" your form as a POST. Seeing the hidden variable does not mean any of your pages were used.

"View source" or Fiddler2 can easily spot the hidden variable and its state on submit.