在HTML表格中显示$ _POST数据

Question

I have prepared a form, which is used to generate a PDF, then download the file with the data submitted. 我已经准备好一张表格，用于生成PDF，然后下载包含提交数据的文件。 In my code I need to do it via mPdf library, which generates the file as follows: 在我的代码中，我需要通过mPdf库执行此操作，该库生成文件的方式如下：

$mpdf = new \Mpdf\Mpdf();
// Write some HTML code:
$html = "Here comes what must be displayed in the PDF file"
$mpdf->WriteHTML($html);
// Output a PDF file directly to the browser
$mpdf->Output('ticket.pdf', \Mpdf\Output\Destination::DOWNLOAD);

In my $html I need to create a table which presents a combination of the data got via $_POST eg However, when I put like below, I have a tons of errors. 在我的$ html中，我需要创建一个表，该表显示通过$ _POST获得的数据的组合，例如，但是，当我像下面这样放置时，会遇到很多错误。

$html = "<table>ID: $_POST['someVariable']</table>";

Below you can find whole code which I use to generate the file, and then download it. 您可以在下面找到用于生成文件然后下载的完整代码。 Could you please help me with this? 你能帮我这个忙吗？ I'd truly grateful for your assistance to a rookie :) 非常感谢您对新手的帮助：）

if ($_SERVER['REQUEST_METHOD'] == 'POST')
{
    $from = filter_input(INPUT_POST, 'from');
    $to   = filter_input(INPUT_POST, 'to');
    $start = filter_input(INPUT_POST, 'start');
    $price = filter_input(INPUT_POST, 'price');
    $length = filter_input(INPUT_POST, 'length');
    $timezoneFrom = getTimezone($from, $airports);
    $timezoneTo = getTimezone($to, $airports);

    validate($from, $to, $start, $price, $length);
    echo "from " . $timezoneFrom . "<br>";
    echo "to " . $timezoneTo . "<br>";

    $dateFrom = new DateTime($start, new DateTimeZone($timezoneFrom));
    echo $dateFrom->format('Y-m-d H:i:s e') . "<br>";
    $dateTo = clone $dateFrom;
    echo "clone of date :";
    echo $dateTo->format('Y-m-d H:i:s e') . "<br>";
    $dateTo->setTimezone(new DateTimeZone($timezoneTo));
    echo "after timezone change:";
    echo $dateTo->format('Y-m-d H:i:s e') . "<br>";
    $dateTo->modify($length . ' hours');
    echo $dateTo->format('Y-m-d H:i:s') . "<br>";
    echo "Data OK";

    }

    require_once __DIR__ . '/vendor/autoload.php';

    $mpdf = new \Mpdf\Mpdf();

     // Write some HTML code:
    $html = "
    <!DOCTYPE html>
    <html>
    <head>
    <style>
        #head {
            text-align: center;
            color: red;
            font-weight: bold;
        }
        table, th, tr, td {
            border: 1px solid black;
        }
    </style>
        <body>
            <table>
                <thead>
                    <tr>
                        <td colspan=\"2\" id=\"head\">SomeTitle</td>
                    </tr>
                </thead>
                    <div class=\"fromTo\">
                        <tr>
                            <td></td>
                            <td>To: ."$_POST['from']".</td>
                        </tr>
                    </div>
                    <div class=\"flightData\">
                        <tr>
                            <td>Departure (local time): $start</td>
                            <td>Arrival (local time)</td>
                        </tr>
                    </div>
                    <div class=\"date\">
                        <tr>
                            <td>$dateFrom</td>
                            <td>$dateTo</td>
                        </tr>
                    </div>
                    <div class=\"FlightPass\">
                        <tr>
                            <td>Flight time:</td>
                            <td>$length</td>
                        </tr>
                        <tr>
                            <td>Passenger:</td>
                            <td></td>
                        </tr>
                    </div>
            </table>
        </body>
    </head>
    </html>";

    $mpdf->WriteHTML($html);

// Output a PDF file directly to the browser
$mpdf->Output('ticket.pdf', \Mpdf\Output\Destination::DOWNLOAD);

Please don't hesitate to provide me with advices and questions if you have some. 如果您有任何建议和问题，请不要犹豫。 Regards. 问候。

Answer 1

You should never pass user input to HTML directly (not even to HTML to PDF input, to keep best practices and support code reusability) as your code then would be XSS vulnerable. 您绝不应该将用户输入直接传递给HTML（甚至不能传递给HTML到PDF输入，以保持最佳实践并支持代码可重用性），因为这样您的代码将容易受到XSS攻击。 You should treat the input correctly with the htmlspecialchars function. 您应该使用htmlspecialchars函数正确处理输入。

$someVariableOutput = htmlspecialchars($_POST['someVariable']);

As to your original question: 关于您的原始问题：

You need to concatenate the string with the variable with the . 您需要将带有变量的字符串连接到. operator: 操作员：

$html = "<table>ID: " .  $someVariableOutput . "</table>";

or you can display the variable in double-quoted string: 或者您可以将变量显示在双引号字符串中：

// the {} are just for a good measure here
// they would be useful when printing eg. an array key.
$html = "<table>ID: {$someVariableOutput}</table>";

在HTML表格中显示$ _POST数据

问题描述

1 个解决方案

解决方案1
0 已采纳 2017-11-22 07:58:07

在HTML表格中显示$ _POST数据

问题描述

1 个解决方案

解决方案1 0 已采纳 2017-11-22 07:58:07

解决方案1
0 已采纳 2017-11-22 07:58:07