$session->set() and forms

[GuruMeditation]

Hi all, I want to process a form, and display an error message under certain conditions. I know there are other ways of doing this, but I kind of like the idea of using $session->set and $session->get to store and retrieve my error messages. This is the first time I have used $session->set().

Is this method ok?

<?php

$error = $session->get($errorMsg);
echo $error;
// Clear the session variable so it doesn't display again if the page is reloaded.
$session->set($errorMsg, "");

    // If the submit button is clicked, process the form.
    if($input->post->submit) {

            $test = $sanitizer->textarea($input->post->test);

        if($test==""){
            $error = "Error: You left it blank!";
            } elseif($test=="poop"){
                $error = "Error: Poop is not allowed!";
            } else {
                $error = "";
            }
            
            $session->set($errorMsg, $error);

            $session->redirect('./');

    // If the submit button hasn't been clicked, render the form.
    } else {

    echo "<form action='./' method='post'>
        <fieldset>
        <legend>Testing a form with validation...</legend>
          <div class='row'>
            <div class='large-12 columns'>
                <textarea name='test' rows='10'></textarea>
            </div>
          </div>
          <div class='row'>
            <div class='large-12 columns'>
              <button class='small' type='submit' name='submit' value='Send'>Test</button>
            </div>
          </div>
        </fieldset>
        </form>
        ";

    }

[GuruMeditation]

Anyone?

[GuruMeditation]

Or, I could use Flashdata I suppose, which seems a lot neater?

<?php

$forbidden = array("mod", "moderator", "admin", "administrator");

foreach($notices as $notice) {
  if($notice instanceof NoticeError) {
    echo "<p>$notice->text</p>";
  }
}

    // If the submit button is clicked, process the form.
    if($input->post->submit) {

            $cp = $sanitizer->text($input->post->captcha);
            $dn = $sanitizer->text($input->post->displayName);

        if($cp==""){
          $session->error("Captcha cannot be blank");
        } elseif($cp!=="zebra") {
          $session->error("Captcha is not correct");
        }

        if($dn==""){
          $session->error("Display name cannot be blank!");
        } elseif(in_array($dn, $forbidden)){
          $session->error($dn . " is a forbidden name.");
        }

        $session->redirect('./');

    // If the submit button hasn't been clicked, render the form.
    } else {

    echo "<form action='./' method='post'>
        <fieldset>
        <legend>Testing a form with validation...</legend>
          <div class='row'>
            <div class='large-12 columns'>
                <label>Type in zebra
                <input type='text' maxlength='30' name='captcha' />
              </label>
            </div>
          </div>
          <div class='row'>
            <div class='large-12 columns'>
              <label>Enter a display name
                <input type='text' maxlength='30' name='displayName' />
              </label>
            </div>
          </div>
          <div class='row'>
            <div class='large-12 columns'>
              <button class='small' type='submit' name='submit' value='Send'>Test</button>
            </div>
          </div>
        </fieldset>
        </form>
        ";

    }

[bwakad]

I tried once using session, but apparently session is set already by PW. Then at PHP website they tell you a session is not really meant for variables which change a lot.

By the way, I use foundation css which has jquery abide for error messages. works great!

[GuruMeditation]

Yeah I've seen conflicting views on things, hence the reason I asked for advice on here. I like the last version with Flashdata and $notices, but I'm unsure if there are any potential problems with it.

Hopefully someone with the knowledge can give me a definate answer as to whether or not that method is ok.

Thanks for the reply.

[Can]

Did you checked those

https://processwire.com/talk/topic/3633-prevent-form-resubmission/

https://processwire.com/talk/topic/3779-use-csrf-in-your-own-forms/

I'm not a pro myself (as you can read in the second post haha), but maybe it helps you or others