Chapter 51. PHP and HTML

There are several stages for which encoding is important. Assuming that you have a string $data, which contains the string you want to pass on in a non-encoded way, these are the relevant stages:

• HTML interpretation. In order to specify a random string, you must include it in double quotes, and htmlspecialchars() the whole value.

• URL: A URL consists of several parts. If you want your data to be interpreted as one item, you must encode it with urlencode().

Example 51-1. A hidden HTML form element <?php echo "<input type='hidden' value='" . htmlspecialchars($data) . "'>\n"; ?>

<?php
    echo "<textarea name='mydata'>\n";
    echo htmlspecialchars($data)."\n";
    echo "</textarea>";
 ?>

<?php
    echo "<a href='" . htmlspecialchars("/nextpage.php?stage=23&data=" .
        urlencode($data)) . "'>\n";
 ?>

When submitting a form, it is possible to use an image instead of the standard submit button with a tag like:

<input type="image" src="image.gif" name="foo">

When the user clicks somewhere on the image, the accompanying form will be transmitted to the server with two additional variables: foo.x and foo.y.

Because foo.x and foo.y would make invalid variable names in PHP, they are automagically converted to foo_x and foo_y. That is, the periods are replaced with underscores. So, you'd access these variables like any other described within the section on retrieving variables from outside of PHP. For example, $_GET['foo_x'].

To get your <form> result sent as an array to your PHP script you name the <input>, <select> or <textarea> elements like this:

<input name="MyArray[]"> <input name="MyArray[]"> <input name="MyArray[]"> <input name="MyArray[]">

Notice the square brackets after the variable name, that's what makes it an array. You can group the elements into different arrays by assigning the same name to different elements:

<input name="MyArray[]"> <input name="MyArray[]"> <input name="MyOtherArray[]"> <input name="MyOtherArray[]">

This produces two arrays, MyArray and MyOtherArray, that gets sent to the PHP script. It's also possible to assign specific keys to your arrays:

<input name="AnotherArray[]"> <input name="AnotherArray[]"> <input name="AnotherArray[email]"> <input name="AnotherArray[phone]">

The AnotherArray array will now contain the keys 0, 1, email and phone.

See also Array Functions and Variables from outside PHP.

The select multiple tag in an HTML construct allows users to select multiple items from a list. These items are then passed to the action handler for the form. The problem is that they are all passed with the same widget name. ie.

<select name="var" multiple="yes">

Each selected option will arrive at the action handler as:

var=option1 var=option2 var=option3

Each option will overwrite the contents of the previous $var variable. The solution is to use PHP's "array from form element" feature. The following should be used:

<select name="var[]" multiple="yes">

This tells PHP to treat $var as an array and each assignment of a value to var[] adds an item to the array. The first item becomes $var[0], the next $var[1], etc. The count() function can be used to determine how many options were selected, and the sort() function can be used to sort the option array if necessary.

Note that if you are using JavaScript the [] on the element name might cause you problems when you try to refer to the element by name. Use it's numerical form element ID instead, or enclose the variable name in single quotes and use that as the index to the elements array, for example:

variable = documents.forms[0].elements['var[]'];

Since Javascript is (usually) a client-side technology, and PHP is (usually) a server-side technology, and since HTTP is a "stateless" protocol, the two languages cannot directly share variables.

It is, however, possible to pass variables between the two. One way of accomplishing this is to generate Javascript code with PHP, and have the browser refresh itself, passing specific variables back to the PHP script. The example below shows precisely how to do this -- it allows PHP code to capture screen height and width, something that is normally only possible on the client side.

<?php if (isset($_GET['width']) AND isset($_GET['height'])) { // output the geometry variables echo "Screen width is: ". $_GET['width'] ."<br />\n"; echo "Screen height is: ". $_GET['height'] ."<br />\n"; } else { // pass the geometry variables // (preserve the original query string // -- post variables will need to handled differently) echo "<script language='javascript'>\n"; echo " location.href=\"${_SERVER['SCRIPT_NAME']}?${_SERVER['QUERY_STRING']}" . "&width=\" + screen.width + \"&height=\" + screen.height;\n"; echo "</script>\n"; exit(); } ?>