Submit values and redirect user from to external URL

Question

What is the equivalence of:

   <form action="https://paypaad.bankpasargad.com/PaymentController" method="POST">
            <input type="hidden" name="content" value='<?php echo $xml ?>' />
            <input type="hidden" name="sign" value="<?php echo $sign ?>" />
            <input type="submit" value="send" name="submit" />
   </form> 

in Drupal 7 ?

I already use following code in my form submit handler, but it doesn't work:

function Chargingform_nameform_submit($form, &$form_state) 
   {
    $options = array();
    $options = array(
        'method' => 'POST',       
        'xml' => $form_state['values']['xml'],
        'sign' => $form_state['values']['sign'],
        'headers' => array('Content-Type' => 'application/x-www-form-urlencoded'),          
    );

   $url = 'https://paypaad.bankpasargad.com/PaymentController'; 
   $response = drupal_http_request($url, $options);
}

How I can submit XML, sign to URL and redirect user to that URL at the same time?

This is my code:

function Chargingform_nameform() {
    $xml = 'PHP Handbook30000130000This is good book.MySQL Handbook25000250000This is a good book too.';
    // Get sing
    $sign ='ewtnXYRWPSalHhna9hgO+Kc0W9Z8JBUeG1FkcKPvZL5w2s588c0/B9r';

    $form['xml'] = array(
       '#title' => t('xml'),
       '#type' =>'hidden',
       '#value'=>$xml,      
    );
    $form['sign'] = array(
       '#title' => t('sign'),
       '#type' =>'hidden',
       '#value'=>$sign,
    );   
    $form['submit'] = array(
      '#type' => 'submit',
      '#value' => t('submit'),
    );
    return $form;
}


function Chargingform_nameform_submit($form, &$form_state) {  
  $options = array();   
  $options = array(
    'method' => 'POST',       
    'xml' => $form_state['values']['xml'],
    'sign' => $form_state['values']['sign'],            
  );    
  $url = 'https//:url';    
  $response = drupal_http_request($url, $options);   
}

I don't know really how to manage it in JavaScript.

Any suggestions?

Answer 1

You can generate form like that using '#type' => 'hidden' form API fields, and using '#action' on form itself.

If you want to submit values to Drupal and then redirect user to external site, you cannot do it directly. HTTP protocol does not allow you to send anything from your server to another "on behalf" of your user. The only way to do it is:

1. Get data from user
2. Save data, process it, do whatever you need
3. Generate form with action pointing to external service (usually payment gateway), and data required by it in hidden fields
4. Use JavaScript to make user's browser submit it.

If you are trying to do it using drupal_http_request, it's your server that starts payment procedure, not client's browser - certainly not what you want. And payment server will not allow switching procedure between different computers - it would be a security risk to allow that. If you could hand your session on payment server to your user, what would prevent attacker from doing the same (but with his bank account, not yours)? I know that's simplified explanation - for more details you may try to ask on Information Security.

Answer 2

It is not a good idea to redirect a POST action. Even if you do, it is not easy or guaranteed to be stable.

If you want to do it, you will have to write custom code to issue a 307 redirect. It won't work with Drupal's redirect functions.

https://softwareengineering.stackexchange.com/a/99966