Warm tip: This article is reproduced from stackoverflow.com, please click
forms php post

Form with POST method returns $_REQUEST but $_POST is empty

发布于 2020-04-08 09:30:06

Using PHP7.x, I have a simple form

<form method='post' action=''>
<input type='text' name ='yourname'>
<input type='submit' name = 'submitted' value = 'here'>
</form>

The submit button works fine. Looking at the POST with developer tools, I see the values of the input fields submitted. So the POST parameters in the Developer tools window show the entered value.

But if my processing page (the 'action' page) contains this code

echo $_POST['yourname'];

The output is null. This statement echo $_REQUEST['yourname'] shows the entered value.

Why doesn't $_POST['yourname'] show a value?

And, I sanitize all form data with this command

$_POST = filter_input_array(INPUT_POST, FILTER_SANITIZE_STRING);

I can change my code to use the $_REQUEST['yourname'], but why doesn't $_POST['yourname'] show data? And, will my filter_input_array() 'clean' the resultant $_REQUEST values?

Added Made the correction to the code (I put the 'action' in the wrong statement in my sample code; the code was not the actual used. Actual code had the 'action' parameter in the proper location. Sample code was a generic sample, as I have seen this problem in many areas of code using 'forms'.

But don't understand the 'close'. This is a programming area (to my understanding), and this is a programming question: "Why does a POST not populate the $_POST array on submit".

And, the secondary question "Does the filter_input_array 'clean' the variables placed in $_REQUEST ?" was not answered. (Maybe that should have been a separate question.)

But disappointed and unclear as to why this is not an appropriate question for this stack. (And yes, I read the 'rules'.)

Questioner
Rick Hellewell
Viewed
88
Rick Hellewell 2020-02-04 02:29

I did some further testing on this, trying to simplify the code and duplicate the problem. The code is on a site that has various 'includes'. So I took my simple code (just a form and then print_r of the $_GET/POST/REQUESTs) to help duplicate the problem.

My includes include these statements to sanitize all inputs:

$_POST = filter_input_array(INPUT_GET, FILTER_SANITIZE_STRING);
$_GET = filter_input_array(INPUT_POST, FILTER_SANITIZE_STRING);

Looks OK, doesn't it? Standard sanitize of the $_GET and $_POST variables. Nothing to see here. Move along.

But look more closely. I've used these statements in my code lots of times. Kept going. But it should be this:

$_POST = filter_input_array(INPUT_POST, FILTER_SANITIZE_STRING);
$_GET = filter_input_array(INPUT_GET, FILTER_SANITIZE_STRING);

Note that the first block is filtering the GET into POST, and the POST into GET. Dyslexic code!

I call that a "SAF" error - "Smack Against Forehead". Or "LCG" - "Look Closely, Grasshopper".

<sigh> Thanks for the help.