Home/ Questions/Q 7652317
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-31T11:44:12+00:00

This problem is keeping me busy all week and I find little to nothing

  • 0

This problem is keeping me busy all week and I find little to nothing on the net …

What I want to do is simple … on my own website, create a server side PHP script that makes a login to another website with valid credentials and downloads a file that I want to process.

I use curl_init(), curl_setopt() and curl_exec() in trying to achieve that. It doesn’t work.

So I stripped down that webpage to figure out what’s wrong.
As you can see in the html code, the form’s action event is the url to retrieve the file, when correct credentials are submitted.

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" >

<body>
<form name="form1" method="post" action="http://otherwebsite/login.aspx?ReturnUrl=/export_file.aspx?id=xxxxxxx" >
<script type="text/javascript" language="JavaScript">
        function Submit_Form()
        {
           document.form1.Login$UserName.value="myname";
           document.form1.Login$Password.value="mypassword";
           //document.form1.Login$LoginButton.click();
           document.form1.submit();
        }
</script>

<input type="hidden" name="Login$UserName" value="myname" />
<input type="hidden" name="Login$Password" value="mypassword" />

<input name="Login$LoginButton" type="submit" />
<br /><a href="javascript:Submit_Form();">Login</a>

</form>
</body>
</html>

Now here is where it gets weird.
If I press the button, it works and I receive the download file.
If I click the hyperlink, i get a page saying to login properly.
When I uncomment the javascript line : click() it works too.

So it comes down to this :
Why does the button submit work and javascript submit doesn’t work ?
Is there a way that the other website’s server check how the form was posted ?
Thank you for your thoughts !

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    When you click the button, its name is included in the POST request because it’s a named submit button. When you use the link, the button’s name doesn’t get passed in the POST data.

    You could probably spoof the button when you use the link by having a hidden field with the name the button should have:

    <input type="hidden" name="Login$UserName" value="myname" />
<input type="hidden" name="Login$Password" value="mypassword" />
<input type="hidden" name="Login$LoginButton" />

    Note it doesn’t need a value because the button it replaces doesn’t have a value setting its text. Just including it should be sufficient.

    • 0