Home/ Questions/Q 518669
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-13T07:57:38+00:00

I have a php page where users may enter data into fields inside a

  • 0

I have a php page where users may enter data into fields inside a form.
The form also has a picture upload utility.
This page is refreshed every time a new picture is uploaded, so to ‘remember’ the values the user ALREADY has filled in, I have this code:

<input type="text" value="<?php echo @$_POST['name'];?>">

This DOESN’T work for drop lists or radios…

I have one solution from a previous Q but that would mean I would have to create all drop lists again in PHP, when they are in HTML now, and it is ALOT of options in the drop lists.

Is there any other way?

Here is the first solution:

$color = $_POST["colors"];
$colors = array("red","green","blue");

<select name="colors">
<?php foreach ($colors as $option) { ?>
  <option<?php print ($option == $color) ? " selected" : ""; ?>>
    <?php print $option; ?>
  </option>
<?php } ?>
</select>

Thanks

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    Sorry to say, but you have to output valid HTML no matter how much of a pain that is. Best suggestion is to wrap it in a helper function and include it. Or even better, go find a good form handling library and use it. This problem has been solved 1000’s of times.

    XSS CONCERN: Your example code has a number of security flaws. Let me illustrate a simple way to handle a form cleanly. The following code illustrates an error-proof way to handle:

    • Reading input
    • Validation
    • Handling errors, with nice messages
    • Re-populating the form
    • Etc…

    Please note the use of htmlspecialchars and ENT_QUOTES where needed. Also, the use of the cond ? val1 : val2 operator ensures that there are no E_STRICT warnings omitted, without the use of @ (which can be terrible for performance).

    <?php
$FirstName = trim(isset($_POST['FirstName']) ? $_POST['FirstName'] : '');
$LastName = trim(isset($_POST['LastName']) ? $_POST['LastName'] : '');
$Gender = trim(isset($_POST['Gender']) ? $_POST['Gender'] : '');

$Action = trim(isset($_POST['Action']) ? $_POST['Action'] : '');

$Errors = array();

switch($Action)
{
case 'Process':
  // validation code here
  if(empty($FirstName))
  $Errors[] = 'First Name is required.';

  if(empty($LastName))
  $Errors[] = 'Last Name is required.';

  if($Gender != 'Male' and $Gender != 'Female')
  $Errors[] = 'Gender is required.';

  if(count($Errors) > 0)
  $break;

  // save data or whatever here

  // Redirect to next page
  header('Location: nextpage.php');
  exit;
}

?>
<html>
<head>
 ...
</head>
<body>

<?php if(count($Errors) > 0) { ?>
   <div class="error">
      <?php foreach($Error as $e) { ?>
         <p><?php echo htmlspecialchars($e); ?></p>
      <?php } ?>
   </div>
<?php } ?>

<form method="post" action="<?php echo htmlspecialchars($_SERVER['REQUEST_URI'], ENT_QUOTES); ?>">
  <p>
  First Name:
  <input type="text" name="FirstName" value="<?php echo htmlspecialchars($FirstName, ENT_QUOTES); ?>" />
  </p>

  <p>
  Last Name:
  <input type="text" name="LastName" value="<?php echo htmlspecialchars($LastName, ENT_QUOTES); ?>" />
  </p>

  <p>
  Gender:
  <select name="Gender">
    <option value=""></option>
    <option value="Male" <?php if($Gender == 'Male') echo 'selected="selected"'; ?>>Male</option>
    <option value="Female" <?php if($Gender == 'Female') echo 'selected="selected"'; ?>>Female</option>
  </select>
  </p>

</form>

</body>
</html>
    • 0