30

I have a php form like this.

<form name="form1" id="mainForm" method="post"enctype="multipart/form-data" action="<?php echo $_SERVER['PHP_SELF'];?>">

</form

In form action I want to use page name with parameters. like house.php?p_id=10111 . But $_SERVER['PHP_SELF'] gives only the house.php (My page full url is house.php?p_id=10111 like this) Please help me to solve this problem. thanks.

7
  • 1
    This is not full url. It's url + GET parameters. Commented Jul 28, 2011 at 17:00
  • 1
    @Alex Ackerman: It’s rather path plus query. Commented Jul 28, 2011 at 17:07
  • 3
    yes. Alex is correct. I'm now using $_SERVER['PHP_SELF']."?P_id=".$id Commented Jul 28, 2011 at 17:16
  • 4
    mixing post and get parameters is poor practice. if you're posting, then use hidden form fields to pass through any 'get'-type values. Commented Jul 28, 2011 at 17:22
  • I disagree with @MarcB that putting query string parameters in an action is bad practice. There are many sites that use query strings to determine what content (page or state) to load and use the contents of POST to carry data. Commented Aug 21, 2013 at 15:44

8 Answers 8

81

How about leaving it empty, what is wrong with that?

<form name="form1" id="mainForm" method="post" enctype="multipart/form-data" action="">

</form>

Also, you can omit the action attribute and it will work as expected.

Sign up to request clarification or add additional context in comments.

6 Comments

Thanks for this. I think this is the easiest and best way to do this.
By leaving it empty, breaks w3c validation (in case you care)
@jBaron Yes, that's the case in HTML5, but you can omit the empty action="" attribute altogether. It will validate and work as expected.
@Shef It is bad practice to use post method for same page. Browser will always alert when one refresh the page.
@Avnishalok The browser will always alert whenever someone refreshes the page after a submit. It doesn't matter if the submission is on a different page or the same page.
|
16

You can leave action blank or use this code:

<form name="form1" id="mainForm" method="post" enctype="multipart/form-data" action="<?php echo $_SERVER['REQUEST_URI'];?>">
</form>

Comments

9

Leaving the action value blank will cause the form to post back to itself.

Comments

7

You can use an echo shortcut also instead of typing out "echo blah;" as shown below:

<form method="POST" action="<?=($_SERVER['PHP_SELF'])?>">

1 Comment

This allows for XSS attacks, you need to filter/sanatize PHP_SELF
4

This is Perfect. try this one :)

<form name="test" method="post" enctype="multipart/form-data" action="<?php echo $_SERVER['PHP_SELF']; ?>">
/* Html Input Fields */
</form>  

1 Comment

This allows for XSS attacks, you need to filter/sanatize PHP_SELF
2

Another (and in my opinion proper) method is use the __FILE__ constant if you don't like to rely on $_SERVER variables.

$parts = explode(DIRECTORY_SEPARATOR, __FILE__);
$fileName = end($parts);
echo $fileName;

About magic and predefined constants: 1, 2.

Comments

1

The easiest way to do it is leaving action blank action="" or omitting it completely from the form tag, however it is bad practice (if at all you care about it).

Incase you do care about it, the best you can do is:

<form name="form1" id="mainForm" method="post" enctype="multipart/form-data" action="<?php echo($_SERVER['PHP_SELF'] . http_build_query($_GET));?>">

The best thing about using this is that even arrays are converted so no need to do anything else for any kind of data.

Comments

0

If you want to be secure use this:<form method="post" action="<?php echo htmlspecialchars($_SERVER["PHP_SELF"]);?>">

Comments

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.