Custom Module: Alternative to Using $this->EE->output->show_message($data) on a Form Submission

Question

I've successfully created a custom module that takes customer information, submits it to Elavon (a payment gateway) and saves the data to a table in the Expression Engine database.

Currently, when a user submits the form, I have some jQuery validation to make sure the data is entered correctly, then once its submitted, I perform some server side validation to ensure that everything is as correct as it can be.

When someone submits the form, and their credit card is declined, I use

$this->EE->output->show_message($data);

to output my error message from Elavon. When they click back to go to the form, all of their data is missing. In my controller, I've added the following to save the data temporarily to a session, where I destroy it once the payment has been completed.

 $data = array(
     "full_name" => isset($_SESSION["full_name"]) ? $_SESSION["full_name"] : "",
     "item_description" => isset($_SESSION["item_description"]) ? $_SESSION["item_description"] : "",
     "amount" => isset($_SESSION["amount"]) ? $_SESSION["amount"] : "",
     "fname" => isset($_SESSION["fname"]) ? $_SESSION["fname"] : "",
     "lname" => isset($_SESSION["lname"]) ? $_SESSION["lname"] : "",
     "address" => isset($_SESSION["address"]) ? $_SESSION["address"] : "",
     "city" => isset($_SESSION["city"]) ? $_SESSION["city"] : "",
     "state" => isset($_SESSION["state"]) ? $_SESSION["state"] : "",
     "zip" => isset($_SESSION["zip"]) ? $_SESSION["zip"] : "",
     "email" => isset($_SESSION["email"]) ? $_SESSION["email"] : "",
     "phone" => isset($_SESSION["phone"]) ? $_SESSION["phone"] : ""
 );

 // Construct $variables array for use in parse_variables method
 $variables = array();
 $variables[] = $data;
 $tagdata = $this->EE->TMPL->parse_variables($tagdata, $variables);

I have placed custom tags, as defined above, in my value portions of my input fields.

 <input name="fname" id="fname" type="text" class="form-control" value="{fname}" />

This works fine for now. When a user submits the form, if there's an error, all but the sensitive credit card information is saved to a session and the form is re-populated.

However, from a UI standpoint, I would much rather show the form with an error message and never use the built in EE show_message() function. My question is, instead of using

 $this->EE->output->show_message($data);

to show the error message, what is the best practice for re-directing back to my form with my error message? Also, I feel that using session variables is a hack way to do things and I feel like there is probably something built into EE that does this for me.

In the final section of my controller, where I call EE's built in show_message() function, I've already tried to call the function I created to instantiate the form, but all I get is a PHP error page that gives me the following error:

Fatal error: Call to a member function parse_variables() on a non-object

Answer 1

Instead of module action, which posts a form to /index.php?action_id=xx, i rather post to the template itself (optionally with an extra segment [1] ) and catch the post-data in the add-on tag on the template itself.

Take a look at freemember and channel-form (formerly safecracker). Basically, inside your plugin / module you check that $_POST[submit] is set and then process and handle the form. You can use {message} tags or tagpairs to output notices, again, you can take a look at the mentioned add-ons for this.

[1] As mentioned in this answer (secure form data) it is good practice to use post/redirect/get (wikipedia) pattern. This prevents multiple submits to a form when a user reloads the page. For instance, when a form sits on /group/template you can post to /group/template/save/ and after success redirect back. The extra (dummy) segment can be helpful in this procedure.

As for the session, you can use $_SESSION, since EE session is rather basic (cookie based?) However i would create an array, put that into the session and add a reference to it. That way you have more of a single point of reference (pun intended) where in the future you can replace the session handling system.

// reference session variable
session_start(); // important, otherwise reference doesn't work
$_SESSION['usersession'] = array();
$usersession &= $_SESSION['usersession'];

$usersession['name'] = 'john';
$usersession['info'] = '....';