siteIcon

Tech Novice Tools

PHP Apps

burgerIcon

Marco Poloexplorer

Stage 2:
Processing Form Submission via GET method

What gives?!

There's no way you could GET what's going on at this point, so we will try to help out with that...

If you arrived at this page by submitting the form at mPolo.php with the default message 'Howdy, Marco', you would have found a weird fragment of code in the URL (address bar) above:

processMPolo1.php?msg=Howdy%2C+Marco%21&
submitBtn=Send+Message
                        

(We broke it into two lines for convenience.)

What does it mean?

When a form is submitted with method 'GET,' the value of any element in the form (text, submit, selections, etc) is stored in the $_GET superglobal array. If an array is like a hotel, the hotel room is labeled with an element's 'name' attribute and the information stored in the room is the 'value' or content of the element. (The 'Clear' button was not included, since its type was 'button' and those are not intended to be used with PHP...they are a JavaScript thing.)

We had 2 elements that were sent: the text input with name 'msg' and the submit element with name 'submitBtn.'

Once the submitBtn ('Send Message') was pressed, the form loaded the 'action' which was the address of the 'processing' page which you were on now. The information was sent via the URL.

After the name of the page in the URL, there is a '?' which means transmission information follows, in the form of a couple of equation-type statements separated by '&' symbols.

See the two equations: msg=Howdy,+Marco! (punctuation was replaced with code-y stuff and spaces were replaced with '+' signs) and submitBtn = 'Send+Message'? Each equation was separated by the delimiter: &

As the page was loaded, PHP did some magic and checked to see if there was content to be found. If so, it output that information in the output div in the body of the webpage.

If no information was found, a default message was generated and displayed instead.

Basic Form Anatomy (Again):

For your convenience, we have listed the form and the associated JavaScript for the Clear button below: (You may have to scroll horizontally to see it all, sorry)

                                
<form id="mpoloForm1" action="processMPolo1.php" method="GET">
    <fieldset>
        <legend>Compose a message:</legend>
        <label>Message:</label>
        <input type="text" id="msg" name="msg" value="Howdy, Marco!" size="35">
        <input type="submit" id="submitBtn" name="submitBtn" value="Send Message">
        <input type="button" id="clearBtn" name="clearBtn" value="Clear" onclick="clearField();">
    </fieldset>
</form>

<script>
        function clearField(){
            var msgField = document.getElementById("msg");
            msgField.value = "";
            msgField.focus();
        }
</script>                                
Cave of Wonders Commentary:

Here's the PHP we encounter before the page ever loads:

                                
if(isset($_GET['msg'])){
    $msg = $_GET['msg'];
}else{
    $msg = "=== No information received ===";
}
                                

The isset function in PHP is used to see if there is any 'msg' information to be found. If so, it's copied from the $_GET superglobal into a PHP variable, $msg.

Otherwise, a default message, $msg is created: No information received

Once the page loads, another PHP fragment in the output division:

                                
<div id="output">
    <?php
        if(isset($_GET['submitBtn'])){
            echo "<h2>Here's a message for Marco: </h2>";
            echo "<p>$msg</p>";
        }else{
            echo "<p class=\"warning\">Close examination of the URL on this page indicates an absence of submitted information via GET</p>";
            echo "<p>$msg</p>";
        }
    ?>
</div>                                

This time, for variety, we check to see if the submitBtn was pressed using the PHP function isset. If it is, we echo out our message along with a cute heading.

If not (we went to this page directly without submitting the form), we get a kind warning along with our default message that no information was received.

Because information sent via GET is visible in the URL, sensitive information should NEVER be sent via GET. There's another way, which we will explore in future stages.

12/17/19


Close examination of the URL on this page indicates an absence of submitted information via GET

=== No information received ===