Redirecting form data to external site

[fuzzyping]

I'm finishing up a simple registration form and am running into some difficulty handling a redirect. In my case, there is a final "submit" input that passes a hidden session value that is used to gather user data from the database. This non-sensitive data then requires two actions:

1) An email is generated to the "owner" with the contents of the "order".

2) The user is redirected to PayPal, along with a series of hidden form values.

The first requirement is successful, but the second is causing errors. I've never attempted a redirect with CGI, much less one with hidden form values, so it's quite likely I'm screwing the pooch. In its current state, it results in the following Apache error:

malformed header from script. Bad header=HTTP/1.1 302 Moved: index.cgi

Here's the relevant sub. If anyone has any ideas, I'd love to hear them. Thanks!

sub paypal_redirect {
        my ($query, $total_cost) = @_;
        my $cgi = CGI->new;
        print $cgi->redirect(-uri => 'https://www.paypal.com/cgi-bin/w
+ebscr', -nph => 1);
        print $cgi->start_form(-method => 'post');
        print $cgi->hidden(-name => '_cmd', -value => '_xclick');
        print $cgi->hidden(-name => 'business', -value => $email);
        print $cgi->hidden(-name => 'item_name', -value => $comment);
        print $cgi->hidden(-name => 'item_number', -value => $query->p
+aram('session'));
        print $cgi->hidden(-name => 'amount', -value => $total_cost);
        print $cgi->hidden(-name => 'no_note', -value => 1);
        print $cgi->hidden(-name => 'currency_code', -value => 'USD');
        print $cgi->end_form;
}

[cLive ;-)]

That won't work. The redirect header is just that - a redirect with no content.

Assuming that the PayPal form accepts QS info, you could get it to work like this:

# build attr hash - expand below...
my %attr = ( _cmd      => '_xclick',
             business  => $email,
             item_name => $comment);

# create query string name/value pairs
my @qsvars=();
for (keys %attr) {
    # escape values
    $attr{$_} = $cgi->escape( $attr{$_} ) ;
 
    # add to qs vars
    push @qsvars, "$_=$attr{$_}";   
}

# create query string
my $qs = join '&', @qsvars;

# send redirect
print $cgi->redirect("https://www.paypal.com/cgi-bin/webscr?$qs");
exit(0);

Or something like that. I've broken down the steps above to make it easier to read, but you could also combine the qs creation into one statement using join and map if you wish.

.02

cLive ;-)

[fuzzyping]

OMG, I can't believe how stupid I am that I didn't think to just append the URI parameters. LOL! Thanks Clive, I'm sure that should work.

Update: Actually, it's still experiencing the same 302 errors. I forgot to emphasize that this is a post method, so I'm not sure this will work after all.

[Chady]

If you want to POST the data, you will need to generate a form to do it, and with the help of some javascript *ducks* you can make it autosubmit.

sub paypal_redirect {
       my ($query, $total_cost) = @_;
       my $cgi = CGI->new;
       print $cgi->header;      # normal header
       print $cgi->start_form(-method => 'post', 
                              -action=>'https://www.paypal.com/cgi-bin
+/webscr');
       print $cgi->hidden(-name => '_cmd', -value => '_xclick');
       print $cgi->hidden(-name => 'business', -value => $email);
       print $cgi->hidden(-name => 'item_name', -value => $comment);
       print $cgi->hidden(-name => 'item_number', -value => $query->pa
+ram('session'));
       print $cgi->hidden(-name => 'amount', -value => $total_cost);
       print $cgi->hidden(-name => 'no_note', -value => 1);
       print $cgi->hidden(-name => 'currency_code', -value => 'USD');
       print $cgi->submit('Continue to PayPal'); # you will need that 
+button in case
                                                 # the user has JS off
+.
       print $cgi->end_form;

       print <<JS;
       <script language="JavaScript">
       <!--
           document.forms[0].submit();
       //-->
       </script>
JS
       
       
}

[Anonymous Monk]

It's a good idea to use named forms (and then document.forms["formname"].submit();)

[cLive ;-)]

If you want the JavaScript to work with a smaller number of browsers that is.

Why is it a good idea to use named forms?

In this instance you only lose by doing so.

cLive ;-)