[SOLVED] Creating a savable form in PHP?

Creating a savable form in PHP?

I have created a simple (but long) HTML form, i need the used to be able to save the form progress and return to it at a later date (security is not a big issue). But i am having trouble going about saving the form state and then recalling it later. (warning, im a noob)

So what is have is:

I have a form

<form action="phpSaveTry1.php" form method="post">

When the form is submitted with the save button

<INPUT TYPE = "Submit" Name = "Save" VALUE = "Save and Submit">

I try to save all the posted variables in a file on the server in the following way... (other suggestions are welcome)

$varNameArray = array("fname","mname","lname","comment","email","website","saveFile");

if (isset($_POST['Save'])) {
for($i = 0; $i < count($varNameArray); ++$i) { //go through every variable and add it to array
    $arrayOfVars[$varNameArray[$i]] = ($_POST[$varNameArray[$i]]);
    }
}
$saveFileName = "NameOfSavedState";
$var_str = var_export($arrayOfVars, true);
$var = "<?php\n\n\$$arrayOfVars = $var_str;\n\n";
file_put_contents(sprintf("/home/pansyc5/public_html/Jul17/SavedForms/%s.php",$saveFileName), $var);

Then in the html header where the form is contained i want to recall the variables

$saveFileName = "NameOfSavedState";
include sprintf("/home/pansyc5/public_html/Jul17/SavedForms/%s.php",$saveFileName);

and recall the values into the fields by first repopulating the variables

for($i = 0; $i < count($varNameArray); ++$i) { //go through every variable and declare it

    $varNameArray[$i] = ( $arrayOfVars[$varNameArray[$i]] );
}

And then repopulating the form by setting the html values as e.g;

 Last Name: <input type="text" name="lname" value="<?PHP print $lname; ?>">

I am new to website design, but this seems like a quite convoluted way of going about saving a form session ( not to mention, it is not working ). What is the correct way of repopulating or saving a form state ?

Solution

Throw all of this code away. By writing data to a PHP file, you're creating a security nightmare. There's really no reason for most of your code. Try something simpler:

session_start();
$_SESSION['lastFormData'] = $_POST;

Then when you populate your form later...

echo '<input name="lname" value="' . htmlspecialchars($_SESSION['lastFormData']['lname']) . '" />';