Can a form submit handler return results without using the $_GET array?

Question

It looks like the default method for passing the result of handling a form submit is GET.

The following statement will redirect to form/result, where a page callback function will extract $content (the result form processing the form) from the query string (attached to the URL) using the $_GET array:

$form_state['redirect'] = array('form/result', array('query' => array('text' => $content)));

This works, but I do not want $content to be a query string (where it can be edited by the user).

Is there an alternative method (e.g. POST) for passing the value of $content to the page callback?

Answer 1

Actually, the default method of the form submission is POST and you're likely doing a POST back to the same page, then doing a redirect to this other page where you're setting params in the URL. The real issue you're having is getting data from the form submission onto the other page. Here's what you can do:

1. If the data is not sensitive you can stuff $content into a cookie and get it back out on your other page. This is still susceptible to user manipulation, so it shouldn't be used for anything sensitive.
2. Your other option is to save the value into the database somehow and fetch it back out on the next page. To do this you'll have to have some sort of scheme to the way you save the data that allows you to look it back up on the next page.

You're kind of using the Form API in a way it wasn't intended to be used. One other option would be to adjust the page that the form appears on to allow it to present the data, then no need for a redirect. That's a more normal use of the FAPI.

Answer 2

You can save $content in a session variable, and then redirect the users to a new page. The page callback of that page will then extract the data from the session data.

$_SESSION['mymodule_content'] = $content;
$form_state['redirect'] = 'form/result';

// The page callback then will execute the following code.
$content = $_SESSION['mymodule_content'];

The pros of using session data are:

• There isn't the length limit GET data has
• The data will not be visible in the browser address bar
• The data can be complex like an array, or an object