action attribute in a form and & amp

Posted: Tue Apr 24, 2007 9:27 am

Trying to follow RN2.10's great example I've been reworking one of my custom modules to try to make it xhtml compliant. I've read many posts here about & amp; and I've read the links too. But none of them answer my question.

If I have a form with an action of:

Code:

action="modules.php?name=Ride_Calendar&file=update_ride

it works, but the w3c validator gripes at me.

if I change it to:

Code:

action="modules.php?name=Ride_Calendar&amp;file=update_ride

the validator is happy but the form doesn't go where it should.

This is nuts. What's worse the validator insists that I have an action attribute right in the Form tag. Generally I assign the action attribute thru Jabascr!pt or would like to since the action can vary depending on users selections. I've taken to assigning a default action in the form tag to make the validator happy but I'm wondering if anyone has a better way.

registered · Posted: Tue Apr 24, 2007 9:50 am

fkelly, I have always used & inside of form action attributes and they work for me. Weird!

Posted: Tue Apr 24, 2007 12:51 pm

Yes, it's very weird. I could swear that last week when I changed things to &amp they were working but today they are not. This is Apache 2.x on a Windows xp box running localhost tests. I'm even having problems with a header redirect with the &amp in it:

Code:

header('location: modules.php?name=Ride_Calendar&file=sel_for_edit')

the above works but with an & in there it doesn't. I haven't tried hrefs yet.

I suppose I need to move the module up to a real server to test but that's a few hours work cause I need to move the tables too.

Posted: Tue Apr 24, 2007 1:55 pm

I too have found that the & does not work in header redirects. I don't use & in those. I do use them in form action URL's, and they work for me on XAMPP on XP doing localhost stuff.

Can you post a form action link that doesn't work?

Posted: Tue Apr 24, 2007 7:41 pm

Gremmie; thanks for looking at this. I posted an action attribute that doesn't work back a couple of posts ago. Of course, it's for my custom module so hard for you to replicate.

Let me try to replicate this more systematically over the next couple of days and I'll report back. In the past Montego has told me where NOT to use &amps but I don't remember exactly what he said. I think that initially, a few days ago, when the validator started complaining about my not having &amps and I put them in, it worked but then today it wasn't working. I know that sounds like the "dog ate my homework" so let me try to duplicate it when that's the only thing I'm changing.

registered · Posted: Wed Apr 25, 2007 6:09 am

Yes, &amp cannot go in Header() and it also cannot be passed into a javascript function and used in come cases (for example, I was passing a URL to a function to then have the function do a window.open - won't work).

I don't know why that wouldn't work in a form action. I've never seen it not work. You may need to convert it to a POST if its currently a GET and use a hidden text field for the additional parameter.

Posted: Wed Apr 25, 2007 6:13 am

... actually, thinking about this further, it makes perfect sense. It is the same issue as Header(). Header is causing the browser to reload with that URL, so it really is not a hyperlink per se. In the same vain, if you are using GET on the form, the same thing is happening because the URL string is being fashioned and sent back to the browser to execute (its why you see the full URL string and its parameters on the browser address bar).

Posted: Wed Apr 25, 2007 7:09 am

That all makes sense (the Header and Get parts) but the form I was using was using method="post". In fact all my forms do. I am going to do some controlled experiments today or tomorrow and I'll post back. Or get back. Humm, thus thinking about what was said, I'm wondering if there could be any difference if Jabascript sets the action attribute or overrides what's in the form. Or if the form tag is like "action="abc.php" method="post" and then the Jabascript sets the action to "def.php" does the method get lost ... or does an & in Jabascript get treated differently than one that's right in the form tag.

Also, no one responded to this, but if you want your action to be set in jabascript would it make sense to say something like this in the form tag: "action="to_be_set" and then make sure that jabascript actually sets it. Or have the form tag point to an action that's really an error page and that should never be executed if the form is processed correctly. I don't think the validator cares about the contents of the action attribute, just that there is one in the form tag. Or do we want to point to some default page because some users may not have jabascript running?

Posted: Wed Apr 25, 2007 7:21 am

Personally, I would make your action simply call the page and use the hidden text field for the parameter that you are showing. Why would you want that parameter to show on the URL string?

You are not really changing the PHP page that you are using right? Aren't you really wanting to change the parameter "file"?

Posted: Wed Apr 25, 2007 8:17 am

Inside the form I have several radio buttons that admins can choose from. Depending on whether and which of those is checked I set the action attribute in Javascript to go to a different PHP file . If none of them is checked, and if the form passes some other validation criteria, I go to the default action attribute, which is a PHP file that produces a report.

After experimenting for an hour here's the results. You can't and don't need to use the & in Jabascript. So, if you set the action attribute there, do it as

Code:

form.action = "modules.php?name=Ride_Calendar&file=ride_report_fancy"

the same attribute, set in the form tag itself, should be:

Code:

form method="post" name="select_rides" action="modules.php?name=Ride_Calendar&amp;file=ride_report_fancy"

The validator ignores the lack of an & in jabascript so you are okay with that. If you put the & in Jabascript it will show up in the address bar and you won't go to the right page.

Posted: Thu Apr 26, 2007 6:07 pm

Always good to have confirmation in experiences. Thanks for sticking with it and relaying this!

Posted: Thu Apr 26, 2007 8:27 pm

It actually makes sense in a perverse sort of way. The browser just sees HTML when the page first loads. I don't think it sees anything in the Jabascript until it's executed and in the case of those submit buttons with action attributes being reset in Jabascript as soon as that happens it's off to load the new page. I'd guess the validator tries to emulate a browser in what it sees. So it gets very upset about an unescaped entity like & in the html part but not in the Jabascript part. At least that's my working theory.

There's probably some point in the process where the browser strips the amp; from the & before going to the action page when the action is in the form tag but it doesn't do the same thing when the action is set in jabascript. I guess.