single page facebook app with embedded form processing - signed request issue

Question

I am working on my first facebook fanpage app with registration form processing on the same page.

The app works like this:

checks if a facebook user is logged in or not -> if not, asks for login, if yes, records basic user data to my database table1 (mysql),
checks if the user liked my facebook page -> if not, asks to click on like button, if yes proceed to next step,
checks if user data is already present in my database table2 -> if not, prints out registration form and send it to same page for processing in mysql
when user has registered the actual exclusive content should show to the user.

My problem is that after sending the registration form the user gets back to the "non-fan" area (altough he had already liked the page therefore should see the fan-only content) and the word "ERROR" gets printed to the top of the page. -> This means "isset($_REQUEST['signed_request'])" at the very beginning of the page returns false.

This is my code:

<?php
require '../facebook-php-sdk/src/facebook.php';
$facebook = new Facebook(array(
'appId'  => 'fb-app-id',
'secret' => 'fb-app-secret',
'cookie' => true,
));
$user = $facebook->getUser();

function saveuser(&$id, &$name, &$email, &$ip, $hostname, $browser, &$like) {
mysql_connect('host', 'user', 'password');mysql_set_charset('utf8');mysql_select_db('mydatabase');
mysql_query("INSERT INTO mytable1 (id,name,email,ip,hostname,browser,fblike) VALUES ($id, '$name', '$email', '$ip', '$hostname', '$browser', $like)");
mysql_close();
}

function checkuser(&$id) {
mysql_connect('host', 'user', 'password');mysql_set_charset('utf8');mysql_select_db('mydatabase');
$query="SELECT phone, round, points FROM mytable2 WHERE fbuserid = " .$id. " ORDER BY timecreated DESC LIMIT 1";
$result=mysql_query($query);
mysql_close();
return $result;
}
?>
<html><head><title>page title</title></head>
<body>
<?php
if (isset($_REQUEST['signed_request'])) {
$encoded_sig = null;
$payload = null;
list($encoded_sig, $payload) = explode('.', $_REQUEST['signed_request'], 2);
$sig = base64_decode(strtr($encoded_sig, '-_', '+/'));
$signed_request = json_decode(base64_decode(strtr($payload, '-_', '+/'), true),true);
} else { echo "ERROR"; }
if ($signed_request['page']['liked']) { $like = 1; } else { $like = 0; }
if ($user) { try {
$user_profile = $facebook->api('/me','GET');
$name = $user_profile['name'];
$email = $user_profile['email'];
$id = $user_profile['id'];
$ip = $_SERVER['REMOTE_ADDR'];
$hostname = gethostbyaddr($ip);
$browser = $_SERVER['HTTP_USER_AGENT'];
saveuser($id, $name, $email, $ip, $hostname, $browser, $like);
} catch(FacebookApiException $e) {
?>
<script type="text/javascript">
//<![CDATA[
var oauth_url = 'https://www.facebook.com/dialog/oauth/';
oauth_url += '?client_id=fb-app-id';
oauth_url += '&redirect_uri=' + encodeURIComponent('https://www.facebook.com/fb-page-name?sk=app_fb-app-id');
oauth_url += '&scope=email'
window.top.location = oauth_url;
//]]>
</script>
<?php } } else { // User not logged in or we need user permission ?>
<script type="text/javascript">
//<![CDATA[
var oauth_url = 'https://www.facebook.com/dialog/oauth/';
oauth_url += '?client_id=fb-app-id';
oauth_url += '&redirect_uri=' + encodeURIComponent('https://www.facebook.com/fb-page-name?sk=app_fb-app-id');
oauth_url += '&scope=email'
window.top.location = oauth_url;
//]]>
</script>
<?php } 
if ($like == 1) { // user is fan of my facebook page
$userdata = checkuser($id);
if (mysql_num_rows($userdata) > 0) { // user is registered
$userphone=mysql_result($userdata,0,telefon);
$roundscompleted=mysql_result($userdata,0,round);
$currentpoints=mysql_result($userdata,0,points);
?>

Here comes extended html content visible only for users who have liked my page and completed the registration form.

<?php } else { // user is not registered
if ($_POST['emailaddress'] != "") { // process user registration
mysql_connect('host', 'user', 'password');mysql_set_charset('utf8');mysql_select_db('mydatabase');
$id = $_POST['fbuserid'];
$name = mysql_real_escape_string($_POST['fullname']);
$email = mysql_real_escape_string($_POST['emailaddress']);
$mobile = mysql_real_escape_string($_POST['phonenumber']);
mysql_query("INSERT INTO mytable2 (fbuserid,regname,regemail,telefon) VALUES ('$id', '$name', '$email', '$mobile')");
mysql_close();

/*
On this point, the page should be reloaded and checkuser() function should return user data.
What happens is "ERROR" gets printed on top of page and user gets back to the "non-fan area".
*/

} else { // user not registered - print registration form ?>
<form id="regisztracio" name="regisztracio" method="post" action="<?php echo $_SERVER['PHP_SELF']; ?>">
<fieldset><legend>Registration form</legend>
<label>Your name</label>
<input type="text" name="fullname" id="fullname" value="<?php echo $name; ?>" />
<br style="clear:both;" />
<label>Your e-mail</label>
<input type="text" name="emailaddress" id="emailaddress" value="<?php echo $email; ?>" />
<br style="clear:both;" />
<label>Your phone number</label>
<input type="text" name="phonenumber" id="phonenumber" />
<br style="clear:both;" />
<input name="fbuserid" type="hidden" value="<?php echo $id; ?>" />
<input name="submitreg" type="submit" class="submit" value="Register" />
</fieldset></form>
<?php } } } else { // non-fan area ?>

Here comes basic html content asking the user to click on the like button and become a fan of my facebook page.

<?php } ?>
</body>
</html>

Thank you very much for your help!

Answer 1

This means "isset($_REQUEST['signed_request'])" at the very beginning of the page returns false.

Of course it does – because the signed_request parameter is only posted to your page on initial page load. It is not present any more, after the user starts navigating inside your app within the iframe.

So, on each request, check if there is as signed_request parameter – if so, save it (it's decoded version, preferably) into the session.

And whenever you need to look up a value – look it up in the session.

single page facebook app with embedded form processing - signed request issue

Question

1 answers

solution1
1 ACCPTED 2012-09-25 11:43:57

single page facebook app with embedded form processing - signed request issue

Question

1 answers

solution1 1 ACCPTED 2012-09-25 11:43:57

solution1
1 ACCPTED 2012-09-25 11:43:57