Question

To start, I am not asking if I can create a POST response from one page to another without use of a form or one of the similar questions which may come to mind. At the start of several of my pages, I automatically force https security with the following require statement:

<?php
if($port == 80) {
    if($_SERVER['SERVER_PORT'] == 443) {
        header('Location: http://'. $_SERVER['HTTP_HOST'] . $_SERVER["REQUEST_URI"]);
        exit;
    }
} elseif ($port == 443) {
    if($_SERVER['SERVER_PORT'] == 80) {
        header('Location: https://'. $_SERVER['HTTP_HOST'] . $_SERVER["REQUEST_URI"]);
        exit;
    }
}
?>

where $port is set directly before calling the PHP require. In some instances where directing from a http to https (or simply changing the URL by person), any POST variables generated from the form on page 1 would be lost on the redirect.

Maybe I am asking the same question as the ‘no form’ but if so, any advice on how to handle based on the requirements is appreciated.

Thoughts

I could put everything into SESSION but this seems like a huge waste of resources. Unless somebody can really show otherwise, I don’t consider this a solution.

Answer 1

I’ve seen other questions that ask essentially the same question, and I believe it’s not really possible to do what you want effectively. My own opinion is it’s going to be a whole lot MORE work to make what you want than just to deploy SESSION:

<?php

session_start();

if (!is_array($_SESSION['posted'])) {
    $_SESSION['posted'] = array('test'=>'test');
} else {
    $_POST = $_SESSION['posted'];
    unset($_SESSION['posted']);
}

echo '<pre>';
echo "<strong>POST:</strong>\n";
print_r($_POST);
echo "\n";
echo "<strong>SESSION:</strong>\n";
print_r($_SESSION);

?>

* Note: I don’t have SSL setup on my server, so I can’t demonstrate that specifically. This is meant to demonstrate reinflating a POST array only from a SESSION-stored array.

http://jfcoder.com/test/postsession.php (Refresh to see it change.)

So if you can rebuild a POST array so easily^, why not just do that? The resources needed to do it across requests that are needed and actually used I believe will be negligible, since you’re really only doing it for a moment.

Unless you have hundreds of thousand or millions of concurrent hits, I can’t imagine the above being a problem resource wise. If it was, then just process it before redirecting. They’ve already sent the data in the clear at that point anyway.

^ Also, you will need to handle file uploads as well, if you need that.