I would like to fill in and submit a form on a web page using python. The form I want to interact with has several drop down boxes which are filled using JavaScript. I have looked at the mechanize library but it doesn't handle JavaScript. Can you suggest an alternate library/method for interacting with the form?
Cheers,
Pete
Selenium RC or Windmill (http://www.getwindmill.com/)
Examine the form's returned GET or POST values;
use urllib2 to submit synthesized requests directly.
The form effectively sends information back to the server (or maybe somewhere else) after you press the submit button.
I don't know how you would directly interact with the form, but you could just send the information back to the server in the same way as submitting the form would (without actually submitting it or physically pressing on things).
So for example some forms put the parameters specified in the form (and their values) at the end of the url in the HTTP request once submitting the form. Others put the parameters in the body of the HTTP request. In PHP i know that PHP automatically takes these parameters out for you (into a global array).
In this case you would simply put your own version of the parameters (names/values) in the HTTP request, by looking a what names/values there are in the forms source code.
Although the form may send its information to the server using javascript...
Sorry if that made no sense.
Related
I use an HTML form to allow the user to upload files.
In order to make adding attachments more user friendly, I added client side code to allow the user to add/remove files (I basically did this as outlined in this answer).
Because I don't want to adjust too much of my server side code, I'd still like to send the form in a regular request, handle it on my server, and return an Http Response (ie: no Ajax, send request from same thread as main page and then redirect or forward the response on my Servlet).
However, the only way to submit the FormData Object is via Ajax.
When I look for ways to send the FormData Object via a regular Http Request (eg: by attaching it to the form), I hear that this is not allowed because it is not safe.
Why can the FormData be submitted via XMLHttpRequest but submitting via regular Http Request (like a regular form submit) is considered not safe to the user? What's the difference?
To phrase this another way: You can mess with attachments if you're submitting them via Ajax but not via a regular request. Why?
If there is a way to submit the FormData in a regular request, I would be interested to hear what it is.
Thanks.
Extra clarification (motivated by comments):
The input element on the form does not accurately represent the user's selections. I allow the user to add/remove files. I do this by creating my own Array of File Objects in the client side code. This new array of File Objects needs to be sent with the request. This is possible with Ajax (ie: by creating a FormData Object), not with regular form submit; why?
The only way to submit the FormData Object is via Ajax
This is not true.
A FormData object is simply a way of encoding binary data before transfer (see MDN for a full outline of its purpose). It is only really required when sending files (ie. binary data) to the server.
If you want to do that without AJAX, add the enctype="multipart/form-data" attribute to your form element and submit it as usual.
Also note that the use of FormData has nothing to do with security, as your question title implies.
I am working on adding a new feature to an existing Classic ASP application. In this feature the user will scan a bar-code which will input its value into a text field in a form within a bootstrap modal. The scanner is configured to send a TAB as well after the data.
What I need is a way to query the database on field exit and populate other fields in the modal with data from the query that is based on the scanned value. I need to do this without reloading the page or closing the modal so the user can verify this information and make changes before saving the form.
What is the best way to do this? I have no issue writing the SP, but do not have any idea how to call it and then return it's values. Can I possibly use JavaScript/PHP for this?
You will need to use some ajax
https://learn.jquery.com/ajax/
Basically you would send a request to your .asp script which will run the stored procedure then send a response using Response.Write.
Then parse that response in jquery.
Unlike ASP Classic, AJAX is a new technology so it works better with JSON.
There aren't many JSON libraries
You can use json2.asp:
https://github.com/nagaozen/asp-xtreme-evolution/blob/master/lib/axe/classes/Parsers/json2.asp
Or if you want you can try it XML, but its unpopular these days and more tedious to parse.
You mentionned PHP, that's not a bad idea because, it's all built in for you see:
http://php.net/manual/en/function.json-encode.php
Hope this helps
Ok, so currently I handle all HTML form submissions in PHP. I submit the form to a PHP file which:
Checks against a cookie created at page load to prevent CSRF.
Contains a require_once() that handles validation.
Runs other logic.
If any of these steps fail, the user is redirected in PHP to the page they came from with an error message.
How I submit the form:
<form method="post" action="filename.php">
This system is fail-safe; as if anything goes wrong, the user is returned to the page they came from even with Javascript disabled.
So my question is; can I create a fail-safe system using just Ajax (an Ajax request to the server on form submission)? So that I don't need this PHP system at all? Is there a recommended procedure/tutorial for this?
I've avoided this so far as the overhead of having both a PHP form handling system as a fail-safe for potential hackers, as well as Ajax, can take several hours per form.
Just to clarify, I don't require support for users that have Javascript disabled. I just want to make sure my system if fail-safe in that situation. I've had a good look around, but it's proving difficult to find clarification on this.
The short answer for the most part is: no.
It is unwise to consider anything client-side as reliable or fail-safe, this is especially true when it comes to validating user input. A rule of thumb is: never trust the user.
Currently, per the description, your form is being submitted to a PHP script that validates form data. This way is going to be your best line of defense since you have a large amount of control on the data you are working with.
It sounds like you want to cut out the form submission and not force another page load. You can use AJAX to pass form information for validation to your script, but your PHP code is still going to be crucial to the validation process.
Basically you want to make your PHP validation solid. Next, start adding some AJAX calls that pass information from forms to your PHP code, but be prepared to fall back to standard form submission if AJAX is unavailable. If there are no problems with AJAX, you can still submit the data, have PHP do its processing, then return a payload indicating success or failure. Keep in mind though, in this context AJAX is just some sugar for the validation. You are only sweetening the deal by saving yourself having to reload a page and transfer the entire document again.
But remember: it is not reliable, and it is not fail-safe. Server side validation is the light at the end of the tunnel.
I was looking on how to get values of form data that are passed with POST requests and found this answer.
I know you you can get GET query parameters quite easily in JavaScript doing window.location.search but is there a way to do similar for POST request or document.forms is my only option?
To expand on what RUJordan said:
When you do a POST, the information is sent to the server using an entirely different method and does not show up in the URL or anywhere else that JavaScript can get access to it.
The server, and only the server, can see it.
Now, it is possible to take some of the form data and fill JavaScript variables and/or hidden form fields so the server can pass data back down to the client.
If you need more help, you'd be better off opening another question explaining exactly what problem you are trying to solve.
Do you want javascript to see the data was POSTed to load the current page?
JavaScript does not have access to the request body (where the POST content is) that loaded the page. If you want to be able to interact with the POSTed parameters, the server that received the request would need to respond with the necessary data written back out on the page where javascript can find it. This would be done after the form was submitted, as part of the response to that POST request.
Or do you want to know what your page could POST form the forms that are on it?
Inspecting document.forms will let you see what could be POSTed later if those forms were submitted. This would be done before the form was submitted, without a request being made.
I have name and email id fields and want to post data to server to another website (if fields are valid) using form tags but i already have one form tag with runat="server", using second form tag causes second form to not show on page. I have JavaScript code to post data to server on form post. I saw something using action on button click, but how do i post data on button click
P.S I don't want to use iFrame, popup.
To send POST data on a form submit, try to use a submit button like this:
<input type="submit" value="POST_DATA" name="POST_PARAMETER_NAME">
Replace POST_DATA with your data you want to submit and replace POST_PARAMETER_NAME with the parameter name you want to access the data on the server.
If you already have a form on the page that uses asp.net web forms to communicate with the server then you would probably need to make an ajax request if you want to post back different data. This is quite easy these days using jQuery. The link bellow shows you how you may do this and how to create a web forms page that would accept your post. This way your current form and page would not need to change which is what it sounds like you are after.
http://encosia.com/using-jquery-to-directly-call-aspnet-ajax-page-methods/