If/else that contains HTML blocks, which contain additional PHP functions

Question 1

I have a form that posts (a,b) values into the following .php file, and displays an error message when the user tries to reach the .php file directly, instead via POST request.

This code is probably pretty messy, for example, I'm not sure I can post <p> tags right away, instead of having them inside the <html> tags, but since it's an if/else function, I'm not sure how to build this in the most efficient way.

<?php
 if ($_SERVER['REQUEST_METHOD'] !== 'POST') {
?>
 <p>You didn't come here through a Post.</p>
<?php
 } else {
if(isset($_POST['a'])){
 switch ($_POST['a']) {
 case "1":
 $var1 = "word1";
 break;
 case "2":
 $var1 = "word2";
 break;
 default:
 $var1 = "other";
 }
}
if(isset($_POST['b'])){
 switch ($_POST['b']) {
 case "1":
 $var2 = "word3";
 break;
 case "2":
 $var2 = "word4";
 break;
 default:
 $var2 = "other";
 }
}
?> 
<!doctype html>
<html>
<head>
<title>test</title>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<style>
#various-styles {
}
</style>
</head>
<body>
<div>
HTML-blocks that contain PHP such as <?php echo $var1; ?>, and <?php echo $var2; ?>.
</div>
</body>
</html>
<?php
 }
?>

Question 2

A few suggestions.

Instead of writing styles in same file use an external style sheet

Also you can restructure it like:

 <!doctype html>
 <html>
 <head>
 <title>test</title>
 <meta http-equiv="Content-Type" content="text/html; charset=utf-8">
 <style>
 #various-styles {
 }
 </style>
 </head>
 <body>
 <div>
 <?php
 if ($_SERVER['REQUEST_METHOD'] !== 'POST')
 {
 ?>
 <p>You didn't come here through a Post.</p>
<?php
 }
 else
 {
 if(isset($_POST['a']))
 {
 $status = "HTML-blocks that contain PHP such as ";
 switch ($_POST['a'])
 {
 case "1":
 $status .= "word1";
 break;
 case "2":
 $status .= "word2";
 break;
 default:
 $status .= "other";
 }
 }
 if(isset($_POST['b']))
 {
 $status .= "and ";
 switch ($_POST['b'])
 {
 case "1":
 $status .= "word3";
 break;
 case "2":
 $status .= "word4";
 break;
 default:
 $status .= "other";
 }
 }
 echo $status;
 ?>
 <!-- other html code else block here -->
 <?php
 }
 ?>
 </div>
 </body>
 </html>

Question 3

thanks, but i'm afraid you have broke it down too much, the output inside the <DIV> is just an example, what If I'm going to have a whole <TABLE> inside with nested div, and I want a certain cell to echo something? I'm looking for a way for having the code of the HTML block as natural as it can be, so it can be easy to spot and modify as well when necessary.

Question 4

@rockyraw: ohh, I see, I'm editing the answer

Question 5

+1 to Midhun MP, the error page also should be valid HTML. Some other notes:

Using indentation in the HTML code would be easier to read/follow:

<!doctype html>
<html>
 <head>
 <title>test</title>
 <meta http-equiv="Content-Type" content="text/html; charset=utf-8">
 <style>
 #various-styles {
 }
 </style>
 </head>
 <body>
 <div>HTML-blocks that contain PHP such as 
 <?php echo $var1; ?>, and <?php echo $var2; ?>.</div>
 </body>
</html>

You should initialize the variables in every code path. If a malcious client send a POST requiest without an a or b field you'll get some warnings in the error log or on the page (depending on the settings of your server and error_reporting):

[error] [client 127.0.0.1] PHP Notice: Undefined variable: a in .../index.php on line 3
[error] [client 127.0.0.1] PHP Notice: Undefined variable: var1 in .../index.php on line 57
[error] [client 127.0.0.1] PHP Notice: Undefined variable: var2 in .../index.php on line 57

I'd set the default value before the isset condition to avoid that:

$var1 = "other";
if(isset($_POST['a'])){
 switch ($_POST['a']) {
 case "1":
 $var1 = "word1";
 break;
 case "2":
 $var1 = "word2";
 break;
 }
}

Instead of this error message:
```
 <p>You didn't come here through a Post.</p>
```
I'd print something helpful. What should the user do? Should they go back to the main page or to the form? Consider linking it.

(You might also find useful #3 here.)

Question 6

Ideally, when an request is unacceptable because it was made using the wrong HTTP method, the response should have a 405 (Method Not Allowed) status code rather than the usual 200 (Success).

To do so, use header('HTTP/1.0 405 Method Not Allowed'). This has to be called before a single byte of the HTML output has been sent; once the HTTP body starts, it is too late to alter the headers.

Question 7

Thanks for the suggestion, why is it more idle? Also, in that Instance I've noticed that Chrome and FF won't display any message, rather a blank page. Does it mean I'll have to add to my htaccess a ErrorDocument 405 /mesaage.php If I want to display some message?

Question 8

I've just tried including a custom message and noticed that while FF/Chrome would display the custom message, IE would still have the 405, is that Ideal?

Midhun MP Midhun MP 3365 silver badges11 bronze badges · Answer 1 · 2014-04-01 19:01:15Z

A few suggestions.

Instead of writing styles in same file use an external style sheet

Also you can restructure it like:

 <!doctype html>
 <html>
 <head>
 <title>test</title>
 <meta http-equiv="Content-Type" content="text/html; charset=utf-8">
 <style>
 #various-styles {
 }
 </style>
 </head>
 <body>
 <div>
 <?php
 if ($_SERVER['REQUEST_METHOD'] !== 'POST')
 {
 ?>
 <p>You didn't come here through a Post.</p>
<?php
 }
 else
 {
 if(isset($_POST['a']))
 {
 $status = "HTML-blocks that contain PHP such as ";
 switch ($_POST['a'])
 {
 case "1":
 $status .= "word1";
 break;
 case "2":
 $status .= "word2";
 break;
 default:
 $status .= "other";
 }
 }
 if(isset($_POST['b']))
 {
 $status .= "and ";
 switch ($_POST['b'])
 {
 case "1":
 $status .= "word3";
 break;
 case "2":
 $status .= "word4";
 break;
 default:
 $status .= "other";
 }
 }
 echo $status;
 ?>
 <!-- other html code else block here -->
 <?php
 }
 ?>
 </div>
 </body>
 </html>

thanks, but i'm afraid you have broke it down too much, the output inside the <DIV> is just an example, what If I'm going to have a whole <TABLE> inside with nested div, and I want a certain cell to echo something? I'm looking for a way for having the code of the HTML block as natural as it can be, so it can be easy to spot and modify as well when necessary.

palacsint palacsint 30.3k9 gold badges82 silver badges157 bronze badges · Answer 2 · 2014-04-01 20:20:31Z

+1 to Midhun MP, the error page also should be valid HTML. Some other notes:

Using indentation in the HTML code would be easier to read/follow:

<!doctype html>
<html>
 <head>
 <title>test</title>
 <meta http-equiv="Content-Type" content="text/html; charset=utf-8">
 <style>
 #various-styles {
 }
 </style>
 </head>
 <body>
 <div>HTML-blocks that contain PHP such as 
 <?php echo $var1; ?>, and <?php echo $var2; ?>.</div>
 </body>
</html>

You should initialize the variables in every code path. If a malcious client send a POST requiest without an a or b field you'll get some warnings in the error log or on the page (depending on the settings of your server and error_reporting):

[error] [client 127.0.0.1] PHP Notice: Undefined variable: a in .../index.php on line 3
[error] [client 127.0.0.1] PHP Notice: Undefined variable: var1 in .../index.php on line 57
[error] [client 127.0.0.1] PHP Notice: Undefined variable: var2 in .../index.php on line 57

I'd set the default value before the isset condition to avoid that:

$var1 = "other";
if(isset($_POST['a'])){
 switch ($_POST['a']) {
 case "1":
 $var1 = "word1";
 break;
 case "2":
 $var1 = "word2";
 break;
 }
}

Instead of this error message:
```
 <p>You didn't come here through a Post.</p>
```
I'd print something helpful. What should the user do? Should they go back to the main page or to the form? Consider linking it.

(You might also find useful #3 here.)

200_success 200_success 145k22 gold badges190 silver badges478 bronze badges · Answer 3 · 2014-04-01 20:51:34Z

1

\$\begingroup\$

Ideally, when an request is unacceptable because it was made using the wrong HTTP method, the response should have a 405 (Method Not Allowed) status code rather than the usual 200 (Success).

To do so, use header('HTTP/1.0 405 Method Not Allowed'). This has to be called before a single byte of the HTML output has been sent; once the HTTP body starts, it is too late to alter the headers.

Share

answered Apr 1, 2014 at 20:51

200_success's user avatar

200_success 200_success

145k22 gold badges190 silver badges478 bronze badges

\$\endgroup\$

2

\$\begingroup\$ Thanks for the suggestion, why is it more idle? Also, in that Instance I've noticed that Chrome and FF won't display any message, rather a blank page. Does it mean I'll have to add to my htaccess a ErrorDocument 405 /mesaage.php If I want to display some message? \$\endgroup\$

rockyraw
– rockyraw

2014年04月02日 11:26:12 +00:00
Commented Apr 2, 2014 at 11:26
\$\begingroup\$ I've just tried including a custom message and noticed that while FF/Chrome would display the custom message, IE would still have the 405, is that Ideal? \$\endgroup\$

rockyraw
– rockyraw

2014年04月02日 12:15:48 +00:00
Commented Apr 2, 2014 at 12:15

Add a comment |

Stack Exchange Network

If/else that contains HTML blocks, which contain additional PHP functions

3 Answers 3

Your Answer

Sign up or log in

Post as a guest

Post as a guest

Linked

Hot Network Questions

If/else that contains HTML blocks, which contain additional PHP functions

3 Answers 3

Your Answer

Sign up or log in

Post as a guest

Post as a guest

Linked

Related

Hot Network Questions