Thank you for your help on zftalk! I’ve gotten started and really love this approach.

I’ve worked to avoid the double submit issue and I just wanted to share my approach that seems to work:

* Javascript part in formvalidation.js*
submit: function(e) {
Event.stop(e);
//stop the submit

var test = $$(‘#’ + this.form.id);

var el = $$(‘#’ + this.form.id + ‘ input.submit’);
if (el) {
el[0].spinBeside(‘Validating’, this.form.id);
el[0].disabled = true; // Simple stopping of double submitting
}

this.doRequest(this.validateUrl + ‘form/form/’ + this.type, true);
},

** And this part is in the onComplete function after failure is set to halt after token error – see below **
if (!data.messages && data.token_error)
{
var html = ‘Critical error: ‘ + data.token_error;
html += ”;

el[0].value = “X”;
el[0].disabled = true;
el[0].addClassName(‘error’);
new Insertion.After(el[0], html);
}
* Server part (see http://phpsecurity.org/ch02.pdf page 27) *
*- index.php -*
if (isset($_POST) && $_POST != array())
{
if (!isset($_SESSION['token'])
|| $_POST['token'] != $_SESSION['token'])
{
die(“{’sucess’: false, ‘token_error’: ‘Invalid token – either you have submitted the form twice or you are an unauthorised user. Please contact admin if this is not correct.’}”);
}

$token_age = time() – $_SESSION['token_time'];
$max_token_age = 60*60*3;
if ($token_age > $max_token_age)
{
die(“{sucess: false; ‘token_error’: ‘Token timeout – you have been away for to long, form invalid.’}”);
}
}

$token = md5(uniqid(rand(), TRUE));
$_SESSION['token'] = $token;
$_SESSION['token_time'] = time();

*- FormValidateController.php -*
protected function sendJsonResponse($return){
// Reset token since AJAX causes multiple calls with the same SESSION token
$_SESSION["token"] = $_POST["token"];
echo (Zend_Json::encode($return));
die();
}

If the form is valid it does a “real” submit of the form. Because you can’t rely on JavaScript validation, you have to validate it again on the server after that submit. In the demo application you just get redirected back to the demo form, but in a real world scenario you would probably want to redirect to something useful, and alert the user that his data has been saved.

The someAction could just be any normal controller action where you would have the need for a form.

onSubmit() of the form:
ajax request to the url in the forms.js, the action should be formAction(), right?
This actions checks all values and validates them and send the json response

if the validation was successful, the javascript performs a page refresh to the someAction(); and validates it again (if the user doesn’t allow js or something else) and then it performs the form

Hope i understood you well, else correct me

I found that I needed a concept of ‘required’ fields. Those fields get checked no matter what, and will raise an error if they are empty(). Non-required fields will only get checked if they have contents. See the demo to get an idea of how that works.

best regards

P.S. Thanks

nice page! I think you’re on a good way with this blog because you always post some nice hints how to work with the Zend Framework and other nice functions like the CSS Charts
This topic over here looks also very interesting because there are a lot of (older) solutions but they don’t fit in the framework. But can you be so kind to post the whole example sourcecode? (for example the Naneau_Validator_Abstract class).

Best regards,
dino