eZHTTPTool: requests, sessions and redirects #

Part 8, reference 10. eZHTTPTool (lib/ezutils/classes/ezhttptool.php) is how kernel code and extensions read the request and the session. Use it instead of $_POST, $_GET and $_SESSION: it handles the session start, logs missing variables, and keeps your code testable.

<?php
$http = eZHTTPTool::instance();

Request variables #

When the variable is missing and the fallback is null, these write "Undefined post variable" to the debug output. Pass a fallback for optional variables:

<?php
$http = eZHTTPTool::instance();
$name = trim( (string)$http->postVariable( 'Name', '' ) );
$page = max( 1, (int)$http->getVariable( 'page', 1 ) );
$ids = array_map( 'intval', (array)$http->postVariable( 'SelectedIDArray', array() ) );
if ( $http->hasPostVariable( 'StoreButton' ) )
{
    // the form's Store button was pressed
}

Every value from the request is untrusted: cast numbers, check strings, and escape on output (Security in extensions). In module views, the kernel also checks the form token on POST (ezformtoken and CSRF).

Session #

Prefix the names with your extension's name (MyExtLastFilter). Keep sessions small: they are read on every request of that user.

Redirects #

In a module view, redirect through the module, which the kernel then carries out at the right moment:

return $Module->redirectTo( '/myext/list' );

eZModule also has redirectToView( $viewName, $parameters ) and redirect( $moduleName, $viewName, $parameters ) (eZModule and module results).

Outside a module (a script, a handler), eZHTTPTool::redirect( $path, $parameters = array(), $status = false, ... ) sends the redirect at once. Never redirect to an address taken from the request without checking that it is on your own site; the kernel limits redirect hosts (eZModule::allowedRedirectHosts()).

Fetching other sites #

eZHTTPTool::getDataByURL( $url, $justCheckURL = false, $userAgent = false, $forceGetRequest = false ) fetches a URL. For anything more than a simple GET, use cURL directly, with timeouts.

Related pages #

• Previous: eZUser and access checks
• Next: eZSys and eZExtension
• View parameters
• Free documentation: this page is free to copy, translate and improve under the GNU FDL 1.3.