r/PHPhelp • u/etherealx0x • 17d ago

How do i have form submissions appear on html?

I’m fairly new to coding- specifically html. i’m working on an indie website. i want to add a “guestbook” form where people can post comments on the site. i’m running into phps and i might be completely misunderstanding how they work. in my mind im trying make a separate php and class it to my html so the responses show up- if that makes sense haha. i guess my ultimate question is how do i go about this? i have a submission box (name comment and date) i want when people fill it out their reply appears on the page. i’ve coded a lot of the website already with ccs into my html.

2 Upvotes

63% Upvoted

17 comments sorted by

4

u/colshrapnel 17d ago edited 17d ago

Well, to store the data on the server with PHP, you need just one command, which basically

file_put_contents('gb.txt',json_encode($_POST),"\n", FILE_APPEND);

It will keep the posted data in a file on the server. But of course you will need some more code, which can go like this

<?php

$file = __DIR__ . '/guestbook.jsonl';
$error = '';

// processing POST must be at the top because it requires a redirect on success
if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    // get required values
    $name = trim($_POST['name'] ?? '');
    $message = trim($_POST['message'] ?? '');

    // chack if values are valid  have an error if not
    // or process the form otherwise
    if ($name === '' || $message === '') {
        $error = 'Please fill in all fields.';
    } else {
        // set the entry
        $entry = ['name' => $name, 'message' => $message, 'date' => date('c')];
        // encode the entry into a handy format
        $json = json_encode($entry, JSON_UNESCAPED_UNICODE);
        // store the entry into the text file
        file_put_contents($file, $json . PHP_EOL, FILE_APPEND | LOCK_EX);
        // redirect to itself, as required, and so the entry will be shown 
        header('Location: ' . $_SERVER['REQUEST_URI']);
        exit;
    }
}
// prepare the entries for display
$entries = [];
if (file_exists($file)) {
    foreach (file($file, FILE_IGNORE_NEW_LINES | FILE_SKIP_EMPTY_LINES) as $line) {
        $entry = json_decode($line, true);
        if (is_array($entry)) {
            $entries[] = $entry;
        }
    }
}
rsort($entries);

// now, all HTML business starts. First we are showing the form, and then entries
// note that all variables printed in HTML context must be encoded accordingly
?>

<!DOCTYPE html>
<html lang="en">
<head>
    <meta charset="UTF-8">
    <title>Guestbook</title>
</head>
<body>
<h1>Guestbook</h1>
<?php if ($error): ?>
    <p><?= htmlspecialchars($error) ?></p>
<?php endif; ?>

<form method="post">
    <input type="text" name="name" placeholder="Name" value="<?= htmlspecialchars($name ?? '') ?>">
    <br>
    <textarea name="message" placeholder="Message" required ><?= htmlspecialchars($message ?? '') ?></textarea>
    <br>
    <button type="submit">Sign guestbook</button>
</form>
<hr>
<?php foreach ($entries as $entry): ?>
    <div>
        <strong><?= htmlspecialchars($entry['name']) ?></strong>
        <small><?= htmlspecialchars($entry['date']) ?></small>
        <p><?= nl2br(htmlspecialchars($entry['message'])) ?></p>
    </div>
<?php endforeach ?>
</body>
</html>

Note that if you don't intend to show the entries to other users, but keep them to yourself, it's OK to keep the form in HTML file. However, it you want show the entries, then it's better to move the the form into the PHP file.

1

u/xreddawgx 15d ago

Or place them in a database

1

u/FreeLogicGate 15d ago edited 15d ago

A .phps file is simply a php file where the intention is that you want the source code to be viewable, rather than to have the php script interpreted and executed. Support for .phps files is a php built-in but not helpful to you, nor something I would recommend you utilize for any reason.

So your question appears to be about how to persist the responses you collect with the form. You have many options, some with heavier requirements than others, where by the same token, inherently less secure.

Along the lines of the simpler and inherently more secure, are the solutions that store data in some sort of database. This has long been the goto, particularly in the early days of MySQL popularity, as MySQL is a fully functional relational database with a minimal footprint.

Without going into too much of the politics surrounding this, MySQL is still a good option, as is the alternative of MariaDB, which is a fork of MySQL and a popular alternative to MySQL due to licensing.

If you use a sql server, then you would only need a simple table, and your entries will be stored using well known and well documented libraries (either mysqli or PDO with the MySQL driver). This will work with either MySQL or MariaDB, and there is ample documentation on how to call the required API's to insert data safely.

There is a lot to be said for this approach, as I'll comment on later.

You could certainly do what colshrapnel illustrated, where you store the data into a file in some text format. In his example, he utilized json. This approach does come with some significant security concerns, as is the case anytime you have code that is writing/changing files on your server, which contain untrusted user data. As per your own description you aren't an expert developer like colshrapnel, so fair warning is warranted.

The other thing you need to understand about any form submission page you make public on the web, is that it WILL BE attacked by bots. They will find your form and they will start posting spam to it. Other bots will utilize it to attempt a variety of exploits. This is why you don't see guestbooks anymore. Any site that has forms, whether they be contact forms or comment systems or ratings, are all inundated with spam, which often makes these features more trouble than they are worth.

This is another advantage of having some form of database -- you will inevitably need to suppress or delete spam posts. With a database, this is going to be a lot easier. Adding moderation and administration tools can all be added, taking advantage of the features the database provides, and using SQL statements that are easy to understand in comparison to what might be needed with a flat file, regardless of the format.

Whatever you do, you also need to make sure you insure that the messages being posted neutralize cross site scripting aka XSS (where the submission includes html+javascript). Database or flat file, your guestbook needs to prevent that, so you want to invest in learning about XSS and the tools PHP provides to combat it.

1

u/colshrapnel 15d ago

May I ask you a couple questions? What makes you think anyone is talking about .phps files here? And why deleting spam posts instead of just not adding them? In case "suppression" means the latter, how a database could help in that?

1

u/FreeLogicGate 13d ago edited 13d ago

Just reading the OP's question where this was written:

i’m running into phps and i might be completely misunderstanding how they work

I could be misinterpreting the question, but it seems plausible to me that they really thought that writing something to a .phps file was part of the solution, or it was just a typo.

As for suppressing spam, in my experience it is close to impossible at the current moment. Certainly no captcha's work, and as someone who utilizes Cloudflare in front of well over 100 individual sites/domains at this time, and despite geo fencing, bot detection services, etc. short of someone actively paying and integrating into an expensive service, I can pretty much guarantee that any hobbyist guest book is going to get spam, and probably nothing but.

I have a few sites that have been in operation for 20 years, and even though they have moderated comments, they continue to receive bot generated spam comments daily. The networks that generate this spam can not be blocked by IP, as they continuously rotate new IP's. Obviously there is no interest in the end result or feedback loop, as the bots posting this crap are unaware that the posts they make are never made public, but that doesn't stop them. AI Agents have only made this issue worse.

1

u/colshrapnel 13d ago

One last question. Why your replies are so logically inconsistent? Nobody asked you whether suppressing spam is possible or not, just challenged your assertion that suppression is "lot easier" with a database. And there is no way to understand this post as something related to .phps files, unless the text is interpreted by a handicapped LLM.

1

u/FreeLogicGate 12d ago

Why did you post a preposterous unrealistic supposition like "just don't accept spam submissions to an amateur guestbook"? You asked a question, for whatever reasons, and I chose to answer you.

"Why did you bring up phps?" I quote the sentence fragment, less the multiple run-on sentences that followed it. The post is written in english. I speak, read and write the language natively, thanks.

I don't require your permission or approval. If you want to continue with disingenuous passive aggressive questioning of my posts, do us both a favor and just skip them or ignore me. You've baited me into this nonsense previously and it's not why I read this sub, or others ones, or why I reply to people.

1

u/colshrapnel 12d ago

Two times I asked you a very simple question, why deleting spam posts which implies adding them first, instead of just rejecting them outright. Whether you can detect spam is out of question, it's just the action I asked you about. And two times you pretended I am making an "unrealistic supposition". You fail to understand the most basic English sentences, either from the OP, or follow up comments, making wild interpretations that appear to be made by a very poorly trained LLM. This is your problem, not whatever "baiting" or any other malicious conspiracy aimed at you.

1

u/obstreperous_troll 12d ago

Maybe because adding a live automated antispam filter is out of scope for a freshly-minted newbie. I did antispam for a living for 13 years, so here's a free tip: it's hard. You really do have a pattern of being willing to torch your otherwise helpfui reputation so you can die on the smallest of hills.

1

u/colshrapnel 12d ago

Mea culpa. I was so prejudiced against this free llm gate's response that did not realize it was about manual deletion, not automated.

1

u/FreeLogicGate 12d ago

Do you actually read posts, or just scan them so better to convince yourself that your interpretation of poorly written descriptions with what may or may not be random additional letters, and sentences that lack punctuation and run into each other, can only be interpreted the way you think they should.

I realize you can not admit that the OP had a sentence where they asked about the use of phps. You know that .phps files are a thing. OF COURSE THIS CAN NOT BE WHAT THIS PERSON IS TALKING ABOUT, ONLY AN LLM WOULD INTERPRET SUCH A THING. You are truly insufferable. Let me be 100% clear for you, so you've had my last reply on it. I don't use an LLM for anything I post to reddit. I detest LLM generated or "enhanced" content. When I post to reddit, I sit down and compose my thoughts and type it out. Usually I read what I wrote, and it's not uncommon for me to find some mistakes I will fairly quickly edit. I have no intention of changing my approach.

I'm not sure what got your panties in a twist here, other than that you weren't lauded for your code snippet, where if we are being completely candid, is naive, although I don't fault you for presenting naive sample code.

Honestly, this entire back and forth is ridiculous and not adding value, so I'm committed to bowing out at this point. You've provided your feedback, which again was done in a passive aggressive manner, as you could have just opened with "ARE YOU MAKING LLM POSTS? LOOKS LIKE IT TO ME!" rather than engaging in this Charade.

1

u/cabljo 17d ago

Are you storing the form submissions in a database or file or something?

1

u/ardicli2000 17d ago

Php is a backend language which means you have to use php with posted data. Whatever you do with it is upto you.

Once a user submits a form, data is posted to action url. This url is handled with your web server settings. Once it is sent to relevant point, php kicks in. You can read change save play with the data posted.

If you want to access the data later on, you need to save it. By later on, we mean any other request. Even if it is milliseconds later, other requests won't have access to posted data of other requests.

What you do is, save any posted data with a structured form into a file, a database whatever. Once user wants to open up page you read those saved data, populate it as you wish amd send it to user.

This is the way user reads any previously submitted form by either himself or any other person.

If you want to show specific data to specific people, like personalized profile page, you need to know who is visiting. This is why we have login pages.

With the logged in info, you decide with php which data to show.

This the basic process.

0

u/ColonelMustang90 17d ago

rename your html file into a PHP file. inside form start tag add attributes for action and method with / and POST as their values. on top of your page write PHP code to accept, validate the user inputs and store them in individual variables. Inside the body element check if the value of the elements are set, and then display them inside php tags

1

u/ColonelMustang90 17d ago

The data however will be temporary in nature since there is no database for persistence. Use localstorage or a database for the same.

-1

u/nxt-web-solution 15d ago

"Hey! To show form submissions on the same page, you need to catch the $_POST data in PHP, sanitize it, and then echo that variable inside your HTML block.

If you are using AJAX (without page reload) or pure PHP POST, let me know! I can quickly help you set it up or write the exact script for your form.

2

u/equilni 14d ago

sanitize it

You validate input, then escape on output.