in reply to Re: Web form to alter files is writing to file before submit button is pressed.
in thread Web form to alter files is writing to file before submit button is pressed.

since people can submit forms by hitting Enter on a text field, in which case the named submit button isn't referenced.

Just FWIW, last I heard, only IE does that. The other browsers will send a submit argument.

As for what to do to avoid that, I either check that the request is POST, or check for a required param's existence. If the request does something that is not read-only (like the OP's script seems to do), I'd very strongly consider changing the form submission to POST from GET.

  • Comment on Re^2: Web form to alter files is writing to file before submit button is pressed.

Replies are listed 'Best First'.
Re^3: Web form to alter files is writing to file before submit button is pressed.
by Anonymous Monk on Mar 11, 2012 at 09:59 UTC

    If the request does something that is not read-only (like the OP's script seems to do), I'd very strongly consider changing the form submission to POST from GET.

    That is against the common accepted wisdom of Post/Redirect/Get

[reply]

      I don't see how that has anything to do with this case -- except that the OP is missing a redirect.

      As it is now, if the user reloads the page, the form will get re-submit (and the file modified) without a single warning. If the method is a POST, the browser will at least warn the user that he may not want to do the reload.

[reply]

        I don't see how that has anything to do with this case

        You suggested switching to a GET request for something that CHANGES the resource being accessed -- this goes specifically against every recommendation and accepted common wisdom

        As it is now, if the user reloads the page, the form will get re-submit (and the file modified) without a single warning. If the method is a POST, the browser will at least warn the user that he may not want to do the reload.

        You specifically suggested making the request a GET request

[reply]

In Section Seekers of Perl Wisdom