Calling javascript form php

Question

I am having a form inside a php script. I am doing the validation using javascript.

<?php

$con = mysql_connect("servername","login","passsword");
if (!$con)
    {
        die('Could not connect: ' . mysql_error());
    }

mysql_select_db("dbadminatms", $con);

if (isset($_POST['email']) && isset($_POST['name']) && isset($_POST['comments']))
{
    $sql="INSERT INTO feedback_comments (posted_by, email, comments_text, comment_date)
        VALUES
    ('$_POST[name]','$_POST[email]','$_POST[comments]',NOW())";
    $emailID = $_POST['email'];
    $postedBy = $_POST['name'];
    $message = $_POST['comments'];

    if (!mysql_query($sql,$con))
    {
        die('Error: ' . mysql_error());
    }
    else
    {
        mail( "[email protected]", "Subject: Comments", $message, "From: $emailID\r\n $postedBy" );
    }
}
    else
{

echo '


<form action="contactus.php" method="POST" id="feedback" onsubmit="javascript:return validate("feedback","name","email","comments");">

                <p id="errorMsg">All fields are required</p>

                <label for="name" class="label" id="nameLabel">Your name: </label><input id="name" type="text" size="30"  name="name" class="field"/>
                <br /><br />
                <label for="email" class="label" id="emailLabel">Your Email id: </label><input id="email" type="text" size="30"  name="email" class="field"/>
                <br /><br />

                    <label for="comments" class="label" id="commentsLabel">Comments:</label>
                  <div id="commentsSection">
                    <textarea name="comments" id="comments" class="ui-corner-all" cols="9" rows="5" tabindex="140"></textarea>
                  </div>

            <p><input type="submit" value="Submit" id="submit"/>&nbsp;<input type="reset" /></p>

        </form>';
}

    mysql_close($con);
?>

Everrything's is working fine but I can't validate the form using javascript.

it's impossible to call javascript form php but from HTML only. You have to figure it out first of all — Your Common Sense
– Your Common Sense, Commented Jan 19, 2011 at 12:47

T.J. Crowder · Accepted Answer · 2011-01-19 12:40:38Z

7

The relevant excerpt is:

onsubmit="javascript:return validate("feedback","name","email","comments");"

Two things:

Your use of double quotes within the attribute will end it prematurely (the browser will only see onsubmit="javascript:return validate(", which is invalid and will be tossed by the JavaScript interpreter). Use single quotes instead within the attribute value:
```
onsubmit="javascript:return validate('feedback','name','email','comments');"
```
Do you actually have a JavaScript function called validate that's included in the page somewhere, either directly or via an external JavaScript file?

Separately, note that if you use onsubmit, you don't use javascript: at the beginning, just:

onsubmit="return validate('feedback','name','email','comments');"

The javascript: pseudo-protocol is only used where the HTML would normally contain a link, as with the href attribute of anchors. onsubmit and similar don't accept links, just JavaScript code, so you don't use it. (It's largely harmless if you do, because coincidentally it looks like a label in JavaScript, and so the code parses okay and runs. But it's wrong.)

Off-topic, but important: NEVER rely on client-side validation; client-side validation is purely a user experience improvement exercise (helping people send you things you'll accept), never a replacement for server-side validation. Your PHP code as quoted is wide open to SQL injection (or even innocent issues — what happens if there's a ' in one of the fields, for instance?). Search for "SQL Injection PHP" to find lots of way so correctly process submitted data.

edited Jan 19, 2011 at 12:40

answered Jan 19, 2011 at 12:31

T.J. Crowder

1.1m201 gold badges2k silver badges2k bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

rdp Over a year ago

Thanks. But my echo statement is in single quotes and onsubmit attribute in double quotes. Now how am I suppose to use quotes for parameters of validate functions.

T.J. Crowder Over a year ago

@dilip: You can escape the single quotes in PHP using the backslash: php.net/manual/en/…

cromestant · Accepted Answer · 2011-01-19 12:35:39Z

2

Plus good practice states that you should sanitize your inputs, never rely only on JS validation, but also do it serverside, and never EVER EEEEEEVER use $_POST['whatever'] directly in your query, its damn dangerous, process the input and try to save yourself from xss, and mostly sql injection.

answered Jan 19, 2011 at 12:35

cromestant

6602 gold badges12 silver badges21 bronze badges

Comments

Ankit · Accepted Answer · 2011-01-19 12:35:13Z

0

You don't need to specify javascriptin onsubmit:

onsubmit="javascript:return validate("feedback","name","email","comments")"

instead do this:

onsubmit="return validate("feedback","name","email","comments")"

and I hope you are putting proper escape charaters for the strings. Use this instead:

onsubmit="return validate(\"feedback\",\"name\",\"email\",\"comments\")"

answered Jan 19, 2011 at 12:35

Ankit

4,8406 gold badges41 silver badges56 bronze badges

Comments

foekall · Accepted Answer · 2011-01-19 13:32:31Z

0

Using jquery is better.

jQuery plugin: Validation

answered Jan 19, 2011 at 13:32

foekall

792 silver badges7 bronze badges

3 Comments

codea Over a year ago

You should post this as a comment, it's not an answer to the question(you'll be able to leave comments with 50 reputation's points)

T.J. Crowder Over a year ago

Please don't post jQuery answers to JavaScript questions.

codea Over a year ago

And by the way, JQuery validation is not better, it's just a plugin using javascript. You can do the same and even better using plain javascript.

Collectives™ on Stack Overflow

Calling javascript form php

4 Answers 4

2 Comments

Comments

Comments

3 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

4 Answers 4

2 Comments

Comments

Comments

3 Comments

Your Answer

Sign up or log in

Post as a guest

Related