I would first like to commend you for actually reading my post and having a go and making some progress yourself. This is something I don't see a lot of around here lately.
Below are the answers to your questions and some critical tips on the code you have written.
Hello,
When I click the 'Send button' on my html page it goes (which is great), but opens the php processing page straight away. It processes the form correctly. However, I fear something there, because I see all the information I entered in form appearing in the address bar too. Don't you see this as a security risk?
The variables are shown in the URL because the method attribute of the form is set to "get". This causes the browser to encode all the form variables within the URL query string (everything after the question mark).
This can be a security issue as any sensitive information can be easily passed on unintentionally (i.e. sending someone a link). The entire URL, including the query string may also be logged by a proxy server (especially in corporate environments).
It is generally only a good idea to use method=get when you are implementing a search feature or if the information being entered is to be used later for the generation of links. In your scenario, it is better to use method="post". This causes the encoded information to be sent within the body of the HTTP request and not the URL.
It is important to remember that the information is not invisible, if the connection is not encrypted. The data is still sent as plain text and can be intercepted.
1) I would like the form on my website to display a page with a message 'Your message has been submitted to us'. How do I create that?
Once you have processed the data successfully, you can redirect to another page by sending an HTTP location header:
header('Location: thank_you.html', True, 303); // 303 = see other
You can also make it a little more personalised by redirecting to a PHP page; e.g. you may want to say "Thank you [Name]" or give the user ticket number they can quote in later correspondence.
To transfer information between the pages, I would recommend a session. Opening a session causes PHP to set a cookie containing a session ID; this session ID is used to recall a file stored on the server (containing variables) for that user each time they make a request. To open a session just call session_start(); at the top of each page and add any variables you wish to be available in other pages to the $_SESSION array.
information.php
<?php
session_start(); // ensure this is statement is executed before any HTML / echo / print output
// notice that we are using the POST variable not get (you also need to change the HTML form method to post too)
$_SESSION['name'] = $_POST['Name'];
header('Location: thank_you.php', true, 303);
?>
thank_you.php
<?php
session_start();
?>
<html>
<body>
<p>Thank you for your message <?php each(htmlspecialchars($_SESSION['name'])) ?> </p>
</body>
</html>
Notice how any output that originally came from a form is escaped with the htmlspecialchars() function, this prevents any HTML entered in the form field (usually maliciously) from being interpreted by the browser.
Notice also how the PHP echo statement is embedded within the HTML and no HTML tags are generated using the echo statement. This improves readability and allows you to maintain the structure of the page; so I would recommend that you do this when mixing HTML and PHP in the same page.
More information on sessions can be found here: http://www.php.net/sessions
2) If a field is left by the user, how do I do it so that is says for example 'you did not your email address'?
You can check weather or not a field has been supplied by a user by using the isset() and doing a simple test for a blank string:
if (! isset($_POST['varname'])) {
// variable never sent, this is usually encountered with <select> fields
}
if (trim($_POST['varname']) == '') {
// variable was sent, but it was left blank
}
I also recommend strongly that you not only verify the form has been filled in correctly, you also validate the input. I.e. if you are expecting an integer, make sure you get one; if you are expecting one of several values, ensure that the values fall into this range.
Unfortunately unsecured forms are one of the most utilised attack vectors for websites that could cause the site, sever or the database to be compromise. This is why it is so important to validate the data sent.
When you determine that a value is entered incorrectly, you can redirect to an error page that shows an error message. This can include a "Go Back" link that asks the user to correct the form and submit again. Again, you can use the session to store information about the error and print this on the error page.
3) Where else can it be sent to? It just shows me the processing php page. Can I create a database with the form so that whenever people submit forms I should be able to see all, or they all get stored somewhere?
You could send an email to the webmaster with a summary of what was entered, you could save the data in a file or you could add a record to a database.
Would you be able to tell me the version of PHP you are using and weather or not it has mysql enabled? You can find out by calling the phpinfo() function.
A) This is the HTML page code.
I recommend that you indent your HTML code to make it more readable. I also recommend that you include a hidden element of the same name for all <select>, checkbox and radio fields. This will ensure that even if the user doesn't make a choice, a variable is still generated in PHP:
<input type="hidden" name="Languages" value = "">
<input type="checkbox" name="Languages[]" value="CSS"> CSS
<input type="checkbox" name="Languages[]" value="CPP"> C++
<input type="checkbox" name="Languages[]" value="Delphi"> Delphi
<input type="checkbox" name="Languages[]" value="Java"> Java
<input type="checkbox" name="Languages[]" value="JavaScript">
Also, If you are using HTML 4 you should not close the <input> tag and <br> tags should be written as <br> not <br /> (this is XHTML).
B) This is the php code for processing it.
As mentioned above, I strongly recommend that you fully validate all your form variables and escape any that you output using htmlspecialchars().
I also recommend that you output only the variables using echo / print and not any HTML.
E.g.:
print "Age range: {$_GET['AgeR']}<br /><br />";
Becomes:
<?php // nothing ?>
Age range: <?php print $_GET['AgeR'] ?> <br><br>
It is also good practice not to produce any output on your form processing script and redirect to another script when producing output. the is desirable because if the use clicks the refresh button on the processing page, it will cause the browse to prompt for the information to be resent. Users will normally just click "yes" without reading it.