Damien: I'd be interested in hearing more detail.<br><br><blockquote>A bunch of clarifications:<br><br>
- displaying results in a POST (on form submission) is just a bad<br>
idea. Don't do that, you should use GET.<br></blockquote>
<br>The converse is a *really* bad idea: using a GET when changing state on the server, of course - this is the path to XSS everywhere. But why is it bad to use a POST to display results? Just using a POST to gather info that you don't want as arguments seems innocuous to me, as long as they're properly handled. An example might be a one-time in-form (non-session) authentication, which must not be a GET. So please elaborate.<br>
<br>
<div class="gmail_quote"><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;"><br>
- if you really want to display results in a POST (remember: don't do<br>
that), use the form submit function for what it is designed to do:<br>
take action. In your case the action is to rebuild the form and<br>
display the result there: store the results in $form_state['storage'],<br>
and display that in your form callback.<br>
<font color="#888888"><br></font></blockquote><div><br>Every multistep form is essentially rebuilding the form based on prior input. What is the difference between that and displaying (correctly processed) results by processing information in the form builder function?<br>
<br>Thanks for your thoughts,<br>-Randy <br></div><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;"><font color="#888888">
Damien<br>
</font></blockquote></div><br><br clear="all"><br>-- <br>Randy Fay<br>Drupal Module and Site Development<br><a href="mailto:randy@randyfay.com">randy@randyfay.com</a><br>+1 970.462.7450<br><br>