How to send HTTP POST request?

[UncleRon]

For a Sunday afternoon, something simple.

I need to pass some name/value pairs to another site (actually to the Bank of Americas' settleup branded site) for credit card processing. They (BofA) requires it come at them as a POST. Now I have to create the form (no problem) and before I send them I want to make sure I get some back. The process BofA uses is to require the fields with their own names on them (fair enough). And they return any fields they don't recognize. (Again fair enough.) Now I would normally bundle up the name/value pairs and attach them to the address as a GET. BofA is refusing to recognize this simple technique.

Question, how is the POST header et.al sent?   If it's a GET I would do this, which they don't like.

print redirect(-url => "https://cart.bamart.com/payment.mart?ioc_merch
+ant_id=$ioc_merchant_id&ioc_order_total_amount=30.00&ecom_billto_post
+al_name_first=$pffname&ecom_billto_postal_name_last=$pflname");

and etc. etc. What do I do to make this a POST instead of a GET?

Thanks

UR

janitored by ybiC: minor format tweaks, for legibility, retitle from "something simple" for improved search results

[Happy-the-monk]

It depends on how you use Perl to do your HTTP requests.
Given you would like to use LWP, you find an example in it's manual when you go looking for "POST".
...actually, you still have to do a little guessing and tinkering, but it will give you the idea.

If you want to use CGI.pm, you could use the post method in the form. However, you need the user to click the submit button then, you cannot do it by HTTP redirect which only works as a GET.

Cheers, Sören

[superfrink]

Just to add a small detail. Often http servers will log the entire GET request but will not log the POST data. This doesn't make POST more secure when transfering data to the server but there's no reason to leave the data laying around in log files for someone to scoop up off of a backup tape or something.

It has been mentioned LWP will let you POST data to the server. LWP is probably the better choice but the command line programs wget and curl will also do POST (get the newest versions though).

[cLive ;-)]

Return a form to browser that the user can submit to BofA (as mentioned in another reply). You can't use LWP - the browser will need to initiate the session so that the user can process through the checkout.

If you want to validate input before forwarding user to BofA:

• perform validation
• present confirmation page listing information entered and two buttons "proceed" and "edit"

Each button is a submit for a seperate form. The "proceed" button is for a form containing all data as hidden fields and method POST for BofA. The "Edit" button is basically a back button (or whatever you choose). That's the easiest way to process this without interupting the user's flow too much.

A final note on integrity - I have no idea how BofA talks back to you about the transaction's success etc but, however it's done, double check the data they processed against that which you sent - otherwise it's trivial for someone to amend the data in the hidden fields to change the nature of the transaction.

You're basically stuck with that unless they provide an API for you to talk to them direct to process the CC - but I'm assuming you can't based on the data you presented here.

.02

cLive ;-)

[bobf]

As others have mentioned, you can use LWP to post data. I thought it might be useful to give you an example of some code I've used in the past (please keep in mind I am far from an expert in this area, so I'm sure others could provide better (or at least alternative) examples):

my $ua = LWP::UserAgent->new;
$ua->timeout( 600 );

my $reqobj = $ua->post( 'http://somewebsite/page.cgi',
                        {
                            Var1   => $value1,
                            Var2   => $value2,
                            Submit => 'Process query',
                        }
                      );

if( ${$reqobj}{_msg} ne 'OK' )
{
    print "\nerror posting data: ${$reqobj}{_msg}\n";
    return 1;
}

my $results = ${ $reqobj }{_content};

The values submitted in the post method are placed in the hash that follows the URL. The website that I was using required a Submit field with the value of Process query (generated when the user hit the 'Submit' button) in order for the CGI script to process the data and return the results, so you might want to keep that in mind as your site might require something similar. Note you can test _msg for success/failure, and _content contains the results. Finally, you probably do not need to change the default setting for the timeout value of the request, but in the example above I set the timeout value to 600 seconds (10 min) (the site I was using typically takes 5-8 min to process a request).

HTH - good luck.

[ccn]

You need to output an HTML form like this:

print <<HTML;
<form action="https://cart.bamart.com/payment.mart" method="post">
<input type="hidden"  name="ioc_merchant_id" value="$ioc_merchant_id">
<input type="hidden"  name="ioc_order_total_amount" value="30">
.....
<input type="submit" value="Process request">
</form>
HTML

Thus a user must push a submit button to process a request. If you don't want user interaction, than get rid submit button and insert "onload" javascript hook which will make autosubmitting the form

[saberworks]

Be careful of some of the replies here, I think they are misunderstanding your question. It sounds like you want to collect user information from a web form, then post the required info to Bank of America for credit card processing, so you don't want to submit the user's form directly, you want to build up a list of key/value pairs and POST that to BofA.

A search on CPAN revealed Business::OnlinePayment::BankOfAmerica. I haven't used that but I have used Business::OnlinePayment::AuthorizeNet and it's all pretty straightforward. If anything, you can view their source to see how they're posting it.