Question

I have a form (that consists of 25+ fields) and the values for these fields, range from a tiny value to a concatenated string. This is like a search tool. Now when the user fills the form and submits the info, he gets to see all the relevant data that matches the criteria in the form. I am displaying 15 records at a time to the user. I have implemented pagination to enable user to see the other records as well.

THE MAIN PROBLEM:

The part, till the users submits the info and gets back the 1st set of data is good. The problem arises when user tries to go to 2nd page (or any page of his choice) via pagination. The user is able to navigate to the other pages but the query that is needed to execute properly for pulling out the results from the DB is not triggered. Notice that initally it was a POST operation that was performed in the form and the pagination performs a GET operation. So I am losing the values of the form that the user has input and I want to retain these values and query the DB with these values.

I am trying to avoid sending the form field values via GET because I fear that the data may exceed the maximum permissible value in the URL (& as it is less secure than a POST operation). There are other operations that can be performed on the results page that can lead to loss of the form values if I try to use a POST operation (like update query). Sessions would not really work as the user can choose to run the same form in different tabs with different inputs to compare the results and this can lead to the data of the older query replaced by the data from the newer query. I haven’t thought of cookies as the user may have chosen to block it. Pretty much all the options seem to be exhausted.

So what can I do to retain the form values, run the proper query and get back the relevant values irrespective of the number of times the same form may be processed by the same user in different browser tabs/windows, without using sessions(given the restrictions on passing data via GET and possibly losing them in POST operations) and be able to perform other activities on the page as well?

Thank you in advance.

Answer 1

First off, GET is no “less” secure than POST. Both are not to be trusted at all (It’s more inviting to modify a url string, but by no means harder)…

You have a few options:

One, would be to keep a global “store” of search results. You can use a db table with id, data where data is a serialized array of the variables. Then when someone submits a search, check to see if the data is in the table. If so, use that id. If not, then serialize the data and insert it (and get the id). Then redirect to a page like: results.php?id=4. That way, they can share the link yet it stays reasonably secure from tampering (they can’t alter the search params). The downside here, is that the table could grow HUGE.

Another would be to base64 encode the data and pass that through as a get parameter (base64_encode(serialize($data));). I would try to stay away from this if you’re concerned with tampering or url length.

Another solution would be to intercept the next link click in JS, and use it to issue a POST back to your server from hidden variables.

EDIT: Removed the session solution. Realized that it wouldn’t work for your problem.