mulipage form

[ice78991]

I am looking into ways of creating a form that spans multiple pages ( with 'Next Step' links on each page)

What is the best way to preserve data between each page. Is it best to use session variables or is it ok to write the form data entered for each step directly to the database table when 'next step' is clicked (and include a 'completed' column to indicate when the user has completed the form)

 

[overmodulation]

I usually use

<cfoutput>
   <input type="hidden" name="previousFormVar" value="#FORM.prevFormVar#" />
</cfoutput>

or you can pass vars through the querystring.

 

[ice78991]

Are there security issues associated with form and url variable methods that are avoided using session variables? Maybe a hacker could tamper with the querystring?

 

[overmodulation]

There are definitely security issues with querystring variables. They can be easily manipulated.

Form data, unless submitted over HTTPS, is also insecure, but not as easily forged as querystring variables.

You could use the SESSION scope which is maintained at the server level. And those time out when the session times out.

 

[jstreich]

You should always not trust your users. Sanitize and validate everything at the server.

Storing or passing from form to form either as a post variable or as a session variable in them selves are not the problem -- it's what you do with it after you get it that's the problem or not.

[plug=shameless]

http://game-master.us/phpx-3.4.0/

[/plug]