We have a webform that uses a webformhandler to post the submission to our credit card processor.

The webform works correctly when executed by itself, but when the form is embedded in a Secondary page I get a blank screen. All the pages that use this webformhandler quit working after the last update to the Drupal core 8.7.5

The webformhandler collects data and writes it to the database, it then does the following:

include(drupal_get_path('module', 'xxx').'/redirect.html');

The redirect_form.html is a page that tells the user we are sending them to our payment processor. The payment processor uses the information we send to create a form that present to the user to collect necessary data. On submit, the payment processor send us a confirmation code (fail/success).

I have narrowed the error to the statement:

include(drupal_get_path('module', 'xxx').'/redirect.html');

the content of /redirect.html is as follows:

<title>Payment Required</title>
<h1>Payment Redirect</h1>
<p>We are now redirecting you to our e-commerce partner, xxx. xxx handles secure payments for xxxxxxxxxxx. If you are not redirected within a few seconds, you do not have Javascript enabled. Please enable Javascript, then click the button below to continue to xxx. Javascript <strong>must</strong> be enabled for you to continue--xxxxxxxxxxx requires Javascript for its processing.</p>
<form action="https://xxx.xxx.xxx/xxx" method="get" name="mainForm" id="mainForm" >
<?php if (!empty($lname)) { ?>
<input type="hidden" name="lname" value="<?php echo $lname; ?>">
<?php } ?>
<input type="hidden" name="itemcode1" value="<?php echo $glcode; ?>">
<input type="hidden" name="amount1" value="<?php echo $cost; ?>">
<input type="hidden" name="ref1type" value="TRANSID">
<input type="hidden" name="ref1val" value="<?php echo $id; ?>">
<input type="hidden" name="ref2type" value="VALCODE">
<input type="hidden" name="ref2val" value="<?php echo $valCode; ?>">
<input type="submit" name="Submit" value="Continue" id="_s">
<script type="text/javascript">
document.getElementById( '_s' ).disabled = true;
  • Thanks for the comment, I will check it out. However, this is an issue with creating a new post and not a redirect of the submitted content by the user. Code worked until the last drupal 8 core update (8.7.5) Commented Jul 26, 2019 at 19:59
  • You can't echo and die in Drupal 8. Instead put the html in a response $response = new Response(); $response->setContent($html); and set the response in $form_state, see one of the answers in the duplicate.
    – 4uk4
    Commented Jul 26, 2019 at 20:50
  • Update: Without changes to the code everything worked within webform (test), and when you link to the form, It is only when the form is embedded in a page that it fails. After adding the code $response = new Response(); $response->setContent($html); it refreshes the page and then jumps to our payment processors site right away. The user does not see the text stating why we are sending them off of our website. Setting $form_state made no noticeable difference. The code changes made the test within webforms fail, as did the form page itself. Commented Jul 26, 2019 at 22:34
  • My comment was about echo/die in a symfony app, not the redirect. Here the question would be, why not use a redirect response with GET parameters?
    – 4uk4
    Commented Jul 27, 2019 at 7:11
  • it is advisable to only use the GET parameter in a request that is not security-relevant, as the data is transmitted via the URL Commented Jul 29, 2019 at 3:13


Browse other questions tagged or ask your own question.