Sunday, May 1, 2011

Can a XML-RPC request be made from an html form?

I'm playing with a new service's very simple API and I'm just curious if its possible to send an xml-rpc request directly from an html form. The api request example is this:

<?xml version="1.0"?>
<methodCall>
<methodName>send</methodName>
    <params>
        <param><value><string>YOUR_API_KEY</string></value></param>
        <param><value><string>msg@mycompany.com</string></value></param>
        <param><value><string>5551231234</string></value></param>
        <param><value><string>Test Message from PENNY SMS</string></value></param>
    </params>
</methodCall>

And my current form iteration is this:

    <form method="POST" enctype="text/xml" action="http://api.pennysms.com/xmlrpc">

            <input type="hidden" name="api_key" value="MYAPIKEY"/>

            <label for="from">From</label>
            <input type="input" name="from" value=""/>

            <label for="phone">Phone</label>
            <input type="input" name="phone" value=""/>

            <label for="text">Text message</label>
            <input type="input" name="text" value="">

            <input type="submit" value="Send"/>

    </form>
From stackoverflow
  • Not without involving either Javascript or server code. The "enc-type" attribute specifies the format that the form data is sent to the server in, and unfortunately "xml-rpc" isn't in the list of accepted formats :)

    Geuis : So I'm also guessing that since this would be cross-domain, using XHR isn't gonna work. Back to server side!
    Patrick McElhaney : You mean the "enctype" attribute, right?
    Ryan Brunner : @Patrick: Whoops, you're right.
  • No, this is not possible from plain HTML. The only standard encodings for submitting form data are application/x-www-form-urlencoded and multipart/form-data.

    You can do this from JavaScript using an XMLHTTPRequest, though only to APIs on the same domain that the HTML came from. After a quick Google search, I found this AJAX XML-RPC client, though I've never used it so I can't vouch for it.

  • That might depend if the server is actually enforcing the enctype

    For example using the technique shown here http://pentestmonkey.net/blog/csrf-xml-post-request you can do cross-site posts of XML POST data.

0 comments:

Post a Comment