Display confirmation screen after form is submitted

[DeNasio]

Hello,

I have a form written in PHP. But spam bots uses my form to send lots of spam messages. What I want to do is display a confirmation screen before the form is actually submitted. The user must enter a verification code they see on screen.

To do this I will have to first store the submitted info as hidden field(s) in the form when displaying the confirmation screen. What I can do is send each submitted variable as a hidden field in the form. But I don't find this to be very elegant. What I want to do is send all submitted info as one hidden field. Any one know how I can do this?

[Jeanco]

I'm not sure why you can't just send it all individually, but if you want to combine it all you can use the implode() and explode() functions to combine and then seperate all you information. Just make sure to use a seperator that the user would never of included in their input.

[Cups]

1. The most elegant, and most popular from what I have seen, is to show the capcha (or whatever) on the page next to the first submit button - on the form.

2. Use a server side session to store the vars

3. Do what you say, somehow store all the options in a single string.

If you are using the GET method in your form you will see them all in the address bar - that value is captured (before parsing by PHP) as $_SERVER['query_string'];

Personally I wouldnt do it, but store query_string in the hidden field.

What if query_string can be HUUUGGGGEEE ? 37 megs?

Work out what the absolute max chars you will accept is, and chop off anything longer, you should always do that anyway. LEts say it 500chars.

If you detect queryString is longer that 500 then abort and redirect anyway ....

HTH

[Mandes]

What I can do is send each submitted variable as a hidden field in the form. But I don't find this to be very elegant. What I want to do is send all submitted info as one hidden field. Any one know how I can do this?

A hidden field is only hidden in so much as its not visible in the form, its not a means of security.

Submit the capcha input along with your data input, if the capcha is wrong abort the operation.

There are also other methods you could consider, ie only allow the formsend function to run if the data came from your page.