submitting form with cURL sometimes works, sometimes doesn't

Question

I use this command to fill out a form in Drupal 6 (create node):

curl -b cookies.txt -d "title=thetitle&menu%5Blink_title%5D=&menu%5Bparent%5D=primary-links%3A0&menu%5Bweight%5D=0&teaser_include=1&body=content+here&format=1&changed=&form_build_id=form-01fbf44be3dab1ea177d17544bce415c&form_token=f1af1b01946065a34e49fdbde8fcc64b&form_id=story_node_form&log=&comment=2&pathauto_perform_alias=1&field_pidio%5B0%5D%5Bembed%5D=&name=admin&date=&status=1&promote=1&op=Save" http://localhost/subdo/node/add/story

It works without any problem; no messages in the terminal and the node is created in Drupal as expected.

After a while, I use that code again without any modification. But instead of posting a new node, the terminal shows the HTML code of the form. It looks like cURL isn't hitting the "Save" button.

Answer 1

Drupal forms are often two-step affairs requiring a preview/approval stage. The form you are seeing is identical and pre-filled out with the values you submitted from the first one, but there will also be a preview of the action on the page and a hidden form field that indicates that the next form submission is being submitted from the preview so the data should actually be saved.

The difference is typically the name of the submit button. On forms that require preview, the submit button will pass the operation as op=Preview and from the form on the preview page it will send op=Save. The good news is that it doesn't actually track this preview stage server-side, it just uses clues from the form to know what step you are at. When submitting with an automated fashion like you are trying to do from like curl, you can skip straight to the real save by including sending op=Save instead of using the value from the initial form.

Additionally, Drupal forms are usually tracked using a unique identifier or token. In order to submit these forms automatically, you will need to download the page with curl, parse it for the form field that contains the unique token (called form_token in DP7), then include that key/value pair in your POST.

At least in Drupal 7 you should have no problem combining these techniques. The form token does not change from the preview to the final, so once you fetch the token you can skip straight to the final save POST.