7 ms·

Self-hosting forms, the sane way

127 points by xz18r 2y ago

Takennickname 2y ago
Is there really no good open source form backend? That doesn't sound right.
- beanclap 2y ago
  Formbricks can do what Formspree does but open source see here: https://formbricks.com/vs-formspree https://formbricks.com/vs-formspree
- rroose 2y ago
  You could use Drupal and the very versatile Webform module: https://www.drupal.org/project/webform https://www.drupal.org/project/webform
ulrischa 2y ago
This is so overengineered. Just a simple web hosting and php script will do it
- ocdtrekkie 2y ago
  I write PHP forms for fun but there's a very valid point the default of this is extremely manual for every form you want to build. I really like the idea of at minimum using a database that creates tables and columns as needed for a form sent at it. At the office we have less proficient users who want to make web forms, but self-hosting the data is important to us.
  - megadal 2y ago
    Yeah but this is using 3 different backend services just to automate self hosted forms. Pretty sure you can do this without 3 different services.
    - ocdtrekkie 2y ago
      That's entirely fair. I don't think I'd end up using the same setup as the author, but it definitely planted some ideas.
    - cchance 2y ago
      I mean one a db.. you’d want that regardless and the others the processor.. and ones the form… you’d need those 3 in some variety anyway and technically you could drop the db if you just want it dumped to email id imagine This is literally a blog recommending to use n8n as your processor… that’s basically it lol he’s just adding ways that can be extended too like noco and metrics
      - megadal 2y ago
        Maybe the article should be titled "Self-hosting forms, the n8n way" then, because if I was working with a dev who did this I would definitely question their sanity. But as an article about a cool way to utilize n8n, this is fair, and perhaps even elegant.
        CoolCold 2y ago
        The author clearly states he is not dev/sysadmin and just playing around for hobby - I think it's totally fine.
  - bdcravens 2y ago
    Everything you're describing could still be done in PHP (or another language)
  - ecoqba 2y ago
    Yeah, but nowadays with GPT new forms can be generated fairly quickly.
  - cess11 2y ago
    Why? If you need more than five forms, invent a small DSL that consumes something like a five column CSV (form element type, label, id, something, something) and craps out some PHP and SQL for you. Maybe make the layout boilerplate configurable through a bit of simple templating.
dearroy 2y ago
I understand your concern, but what about an open-source form builder that gives you control over what’s on your site? https://news.ycombinator.com/item?id=39895960 https://news.ycombinator.com/item?id=39895960
thehias 2y ago
This is supposed to be the sane way? Certainly not! You guys know that you can use "mailto:" as form action, yes? No backend stuff needed.
- pspeter3 2y ago
  I had no idea that you could use the mailto: URL for a form action.
  - thih9 2y ago
    Same. How would that work? What would be the end result (email body)?
    - bdcravens 2y ago
      It passes all form fields in URL encoded format in the body (example, name=Billy+Cravens&state=TX)
      - GrantMoyer 2y ago
        Looks like it can also be plaintext encoded[1], so something like: name=Billy%20Cravens state=TX [1]: https://html.spec.whatwg.org/multipage/form-control-infrastructure.html#submit-mailto-body https://html.spec.whatwg.org/multipage/form-control-infrastr...
      - codetrotter 2y ago
        Sounds like a really bad UX I think if my mom was trying to submit a form, and it opened her email client with a body consisting of URL encoded data she’d probably just close the email client thinking that something went wrong. Then she’d try again and the same thing would happen again. Then she might call me, and I’d probably tell her to just forget about it and try to call them on the phone instead or give up and try another company instead.
        vaylian 2y ago
jauntywundrkind 2y ago
I'll dare to say I like it! N8n seems to have a pretty fine gui for configuring little pipelines, sort of alike node-red. If the author wanted to embellish & enhance what they have there's a variety of other connectors & processors they could easily snap into place. It's easy to glance at a pipeline and see what the general shape is. This high level world feels much more normative & clear than scratching together "simple" php scripts. Ditto for sending data into nocodb. An Airtable spreadsheet/database like system, with a good gui, with form submissions being fed into a spreadsheet: it's again nicely high level. It integrates with other documents or reports, if you want. It's easy to access from the web. It's a very slick very user friendly solution that still brings a ton of power. Another huge win for a high level system. I too had an initial WTF reaction, are you serious reaction. But it wasn't that hard to find some empathy when I tried. I didn't have to work that hard to appreciate what the post is going for, to envision what the actual usage/configuration looked like, and to see there is a pretty neat high level set of guis here that are used to program a very flexible small little pipeline. And I can see how each piece is extremely malleable by end users. That freedom to rework & reshape this system freely is really neat. There may be good tailor made solutions that we can agree to dub as "simpler" for form handling, but the composability & flexibility of this end-user driven solution is super neat & super compelling to me. These tools are extremely generic & could be used for all manners of tasks, and that is enormously compelling, to good general systems that we can use to tackle all manners of tasks. This is a cool pick of tools to bring together.
- cchance 2y ago
  THIS! And the authors thoughts about why are well spelt out. Not to mention that this seems infinitely more flexible than what some other people are recommending. Like theirs an entire thread of people somehow acting like dumping forms to a mailto: handler that the client then has to send via a hopefully configured mail client is somehow a realistic and reliable option
47282847 2y ago
I use https://www.formtools.org https://www.formtools.org (php) but I wish there were more self-hosted options.
- V__ 2y ago
  There are quite a few, at the top of my head: getinput.co, quillforms.com, heyform.net snoopforms.com
vidyesh 2y ago
Much simpler solutions exist like https://formsubmit.co/ https://formsubmit.co/ And for others who use the static hosts' free tiers for hobby projects, Cloudflare provides form submissions to your static pages, netliffy forms is quite generous too https://www.netlify.com/platform/core/forms/ https://www.netlify.com/platform/core/forms/
- cchance 2y ago
  Except.. as the first half of the page says he’s trying to avoid relying on third party services and to self host it
  - vidyesh 2y ago
    Yes, they too mention that service but for work purposes. I just find it odd that this is now considered a sane way for hobby projects. I would rather have something like this for a client who wants complete control of their data.
- irq-1 2y ago
  Netlify forms looks like it could be great, but the pricing is awful: 100 per site /month ($19+ when exceeded) Cloudflare form plugin sets up a worker/handler, which is cheap and easy. It does require coding though, unlike the formsubmit.co link. https://developers.cloudflare.com/pages/functions/plugins/static-forms/ https://developers.cloudflare.com/pages/functions/plugins/st...
  - vidyesh 2y ago
    That static form plugin sends submissions to Cloudflare KV Storage, I only recently started experimenting with Cloudflare offerings so haven't tried KV yet but does it get populated in the Cloudflare dashboard? If not, then that would be another thing to build. And about Netlify. If you are getting more than 100 submissions/month on your hobby project, I think it might be time to consider some better serious solutions ;)
Doohickey-d 2y ago
If you want your forms submissions in a spreadsheet, it's also possible using only Google Apps Script: https://github.com/levinunnink/html-form-to-google-sheet https://github.com/levinunnink/html-form-to-google-sheet
CPLX 2y ago
For those that actually want a SaaS type tool for this and don’t want to use Jotform, which is utterly horrible, I recommend Fillout, which has been a joy to use and is seamlessly integrated with a bunch of services like AirTable and Dropbox and so on. Even if you do want to eventually build your own it’s ridiculously fast as a prototyping tool, can pre-fetch data and use conditional logic and accept URL parameters and all that out of the box.
progx 2y ago
Or just use PHP and done.
- cloudking 2y ago
  +1 not sure how OP proposal for a hobby website form is "sane". You can solve this with a simple PHP script
bgdam 2y ago
> that was secure and wouldn’t give me a headache, so number 3 was off as well. Is having a backend controller that securely writes to a DB when a url is posted to that difficult in PHP, that this 'sane' way is preferred? Isn't it the most basic of CRUD setups? I can understand doing this because n8n has a quick way to send emails (at least that's what I assume based on this article), but I really don't understand how this over engineered solution is supposed to be the sane way.
- dartos 2y ago
  Security in php is a headache. Many crud apps which separate the frontend and backend have form validation and sanitization on the frontend and backend (partly by virtue of converting raw input into escaped json strings), but IIRC isn’t as straightforward in php.
  - pbowyer 2y ago
    > Security in php is a headache. It really isn't.
  - kugelblitz 2y ago
    Security in vanilla php using old tools is a headache. I use Symfony and using the form component (https://symfony.com/doc/current/components/form.html https://symfony.com/doc/current/components/form.html) you can achieve much of what is needed. If you use the framework as well (which is very modular nowadays) you also have security built-in (https://symfony.com/doc/current/forms.html https://symfony.com/doc/current/forms.html). But probably not as fast as a "quick and loose" approach if you don't know Symfony yet, but extendible and secure (if you do know Symfony, it might be faster than the vanilla php approach, because you can avoid much of the "generic" code, the validators, the error handling, avoid SQL and XSS injection).
  - echoangle 2y ago
    Im not sure what’s so hard about doing it in PHP. Can I not just get all the data from the GET/POST-Data-Assocarray, get the form fields I want, and put them into a prepared statement to save them to the DB? What’s the vulnerability here? Maybe add an CSRF Token for extra security and I think you’re done, or am I missing something?
lol768 2y ago
How does validation work with the approach that the author advocates for? Is this something "n8n" does? I've gone to learn more about it, and it describes itself as an "AI-native workflow automation" tool. What the f** is that meant to actually mean?
themgt 2y ago
On one of my sites, I needed to install a form with file upload capability. Soo ... the file upload is happening via JSON webhook? Seems like this was defined as the scope and then file upload was just never mentioned again.
jpm_sd 2y ago
Makes me miss the bad old days of Perl scripts and cgi-bin directories... It was, at least, simple.
pembrook 2y ago
It seems like an extremely convoluted way to receive what will pretty much exclusively be automated spam submissions since I’m not seeing any protection methods mentioned. Attacks on any form on the open web have gotten absurdly bad in recent years — hope the author is using something like Cloudflare + captcha.
deleted 2y ago
[deleted]
devmor 2y ago
Jesus, I can't believe I'm saying this in 2024 but just use a php script and an sqlite file.
pentagrama 2y ago
A fully self hosted solution that for me is good enough and more easy is a WordPress site with the plugin WPforms (free version). No third party services used. Update: not sure if the WPforms free version supports file uploads as the OP needs.
- omnimus 2y ago
  This is imho wrong approach. Wordpress gives you extremely flexible possibilities but its hard to maintain. Like you really need to keep it updated or you will get hacked (every wp security hole gets hyper targeted). That means trust plugin authors they will keep up to date. WP is suited for smaller/mid businesses that keep it maintained but its not hands off. Coding php/symfony form by hand (if you can do it) might be security through obscurity but realistically it will probably just work for a decade without issues or maintenance.

127 points by xz18r 2y ago

Takennickname 2y ago

Is there really no good open source form backend? That doesn't sound right.

beanclap 2y ago
Formbricks can do what Formspree does but open source see here: https://formbricks.com/vs-formspree https://formbricks.com/vs-formspree
rroose 2y ago
You could use Drupal and the very versatile Webform module: https://www.drupal.org/project/webform https://www.drupal.org/project/webform

ulrischa 2y ago

This is so overengineered. Just a simple web hosting and php script will do it

ocdtrekkie 2y ago
I write PHP forms for fun but there's a very valid point the default of this is extremely manual for every form you want to build. I really like the idea of at minimum using a database that creates tables and columns as needed for a form sent at it. At the office we have less proficient users who want to make web forms, but self-hosting the data is important to us.
- megadal 2y ago
  Yeah but this is using 3 different backend services just to automate self hosted forms. Pretty sure you can do this without 3 different services.
  - ocdtrekkie 2y ago
    That's entirely fair. I don't think I'd end up using the same setup as the author, but it definitely planted some ideas.
  - cchance 2y ago
    I mean one a db.. you’d want that regardless and the others the processor.. and ones the form… you’d need those 3 in some variety anyway and technically you could drop the db if you just want it dumped to email id imagine This is literally a blog recommending to use n8n as your processor… that’s basically it lol he’s just adding ways that can be extended too like noco and metrics
    - megadal 2y ago
      Maybe the article should be titled "Self-hosting forms, the n8n way" then, because if I was working with a dev who did this I would definitely question their sanity. But as an article about a cool way to utilize n8n, this is fair, and perhaps even elegant.
      - CoolCold 2y ago
        The author clearly states he is not dev/sysadmin and just playing around for hobby - I think it's totally fine.
- bdcravens 2y ago
  Everything you're describing could still be done in PHP (or another language)
- ecoqba 2y ago
  Yeah, but nowadays with GPT new forms can be generated fairly quickly.
- cess11 2y ago
  Why? If you need more than five forms, invent a small DSL that consumes something like a five column CSV (form element type, label, id, something, something) and craps out some PHP and SQL for you. Maybe make the layout boilerplate configurable through a bit of simple templating.

dearroy 2y ago

I understand your concern, but what about an open-source form builder that gives you control over what’s on your site? https://news.ycombinator.com/item?id=39895960 https://news.ycombinator.com/item?id=39895960

thehias 2y ago

This is supposed to be the sane way? Certainly not! You guys know that you can use "mailto:" as form action, yes? No backend stuff needed.

pspeter3 2y ago
I had no idea that you could use the mailto: URL for a form action.
- thih9 2y ago
  Same. How would that work? What would be the end result (email body)?
  - bdcravens 2y ago
    It passes all form fields in URL encoded format in the body (example, name=Billy+Cravens&state=TX)
    - GrantMoyer 2y ago
      Looks like it can also be plaintext encoded[1], so something like: name=Billy%20Cravens state=TX [1]: https://html.spec.whatwg.org/multipage/form-control-infrastructure.html#submit-mailto-body https://html.spec.whatwg.org/multipage/form-control-infrastr...
    - codetrotter 2y ago
      Sounds like a really bad UX I think if my mom was trying to submit a form, and it opened her email client with a body consisting of URL encoded data she’d probably just close the email client thinking that something went wrong. Then she’d try again and the same thing would happen again. Then she might call me, and I’d probably tell her to just forget about it and try to call them on the phone instead or give up and try another company instead.
      - vaylian 2y ago

jauntywundrkind 2y ago

I'll dare to say I like it! N8n seems to have a pretty fine gui for configuring little pipelines, sort of alike node-red. If the author wanted to embellish & enhance what they have there's a variety of other connectors & processors they could easily snap into place. It's easy to glance at a pipeline and see what the general shape is. This high level world feels much more normative & clear than scratching together "simple" php scripts. Ditto for sending data into nocodb. An Airtable spreadsheet/database like system, with a good gui, with form submissions being fed into a spreadsheet: it's again nicely high level. It integrates with other documents or reports, if you want. It's easy to access from the web. It's a very slick very user friendly solution that still brings a ton of power. Another huge win for a high level system. I too had an initial WTF reaction, are you serious reaction. But it wasn't that hard to find some empathy when I tried. I didn't have to work that hard to appreciate what the post is going for, to envision what the actual usage/configuration looked like, and to see there is a pretty neat high level set of guis here that are used to program a very flexible small little pipeline. And I can see how each piece is extremely malleable by end users. That freedom to rework & reshape this system freely is really neat. There may be good tailor made solutions that we can agree to dub as "simpler" for form handling, but the composability & flexibility of this end-user driven solution is super neat & super compelling to me. These tools are extremely generic & could be used for all manners of tasks, and that is enormously compelling, to good general systems that we can use to tackle all manners of tasks. This is a cool pick of tools to bring together.

cchance 2y ago
THIS! And the authors thoughts about why are well spelt out. Not to mention that this seems infinitely more flexible than what some other people are recommending. Like theirs an entire thread of people somehow acting like dumping forms to a mailto: handler that the client then has to send via a hopefully configured mail client is somehow a realistic and reliable option

47282847 2y ago

I use https://www.formtools.org https://www.formtools.org (php) but I wish there were more self-hosted options.

V__ 2y ago
There are quite a few, at the top of my head: getinput.co, quillforms.com, heyform.net snoopforms.com

vidyesh 2y ago

Much simpler solutions exist like https://formsubmit.co/ https://formsubmit.co/ And for others who use the static hosts' free tiers for hobby projects, Cloudflare provides form submissions to your static pages, netliffy forms is quite generous too https://www.netlify.com/platform/core/forms/ https://www.netlify.com/platform/core/forms/

cchance 2y ago
Except.. as the first half of the page says he’s trying to avoid relying on third party services and to self host it
- vidyesh 2y ago
  Yes, they too mention that service but for work purposes. I just find it odd that this is now considered a sane way for hobby projects. I would rather have something like this for a client who wants complete control of their data.
irq-1 2y ago
Netlify forms looks like it could be great, but the pricing is awful: 100 per site /month ($19+ when exceeded) Cloudflare form plugin sets up a worker/handler, which is cheap and easy. It does require coding though, unlike the formsubmit.co link. https://developers.cloudflare.com/pages/functions/plugins/static-forms/ https://developers.cloudflare.com/pages/functions/plugins/st...
- vidyesh 2y ago
  That static form plugin sends submissions to Cloudflare KV Storage, I only recently started experimenting with Cloudflare offerings so haven't tried KV yet but does it get populated in the Cloudflare dashboard? If not, then that would be another thing to build. And about Netlify. If you are getting more than 100 submissions/month on your hobby project, I think it might be time to consider some better serious solutions ;)

Doohickey-d 2y ago

If you want your forms submissions in a spreadsheet, it's also possible using only Google Apps Script: https://github.com/levinunnink/html-form-to-google-sheet https://github.com/levinunnink/html-form-to-google-sheet

CPLX 2y ago

For those that actually want a SaaS type tool for this and don’t want to use Jotform, which is utterly horrible, I recommend Fillout, which has been a joy to use and is seamlessly integrated with a bunch of services like AirTable and Dropbox and so on. Even if you do want to eventually build your own it’s ridiculously fast as a prototyping tool, can pre-fetch data and use conditional logic and accept URL parameters and all that out of the box.

progx 2y ago

Or just use PHP and done.

cloudking 2y ago
+1 not sure how OP proposal for a hobby website form is "sane". You can solve this with a simple PHP script

bgdam 2y ago

> that was secure and wouldn’t give me a headache, so number 3 was off as well. Is having a backend controller that securely writes to a DB when a url is posted to that difficult in PHP, that this 'sane' way is preferred? Isn't it the most basic of CRUD setups? I can understand doing this because n8n has a quick way to send emails (at least that's what I assume based on this article), but I really don't understand how this over engineered solution is supposed to be the sane way.

dartos 2y ago
Security in php is a headache. Many crud apps which separate the frontend and backend have form validation and sanitization on the frontend and backend (partly by virtue of converting raw input into escaped json strings), but IIRC isn’t as straightforward in php.
- pbowyer 2y ago
  > Security in php is a headache. It really isn't.
- kugelblitz 2y ago
  Security in vanilla php using old tools is a headache. I use Symfony and using the form component (https://symfony.com/doc/current/components/form.html https://symfony.com/doc/current/components/form.html) you can achieve much of what is needed. If you use the framework as well (which is very modular nowadays) you also have security built-in (https://symfony.com/doc/current/forms.html https://symfony.com/doc/current/forms.html). But probably not as fast as a "quick and loose" approach if you don't know Symfony yet, but extendible and secure (if you do know Symfony, it might be faster than the vanilla php approach, because you can avoid much of the "generic" code, the validators, the error handling, avoid SQL and XSS injection).
- echoangle 2y ago
  Im not sure what’s so hard about doing it in PHP. Can I not just get all the data from the GET/POST-Data-Assocarray, get the form fields I want, and put them into a prepared statement to save them to the DB? What’s the vulnerability here? Maybe add an CSRF Token for extra security and I think you’re done, or am I missing something?

lol768 2y ago

How does validation work with the approach that the author advocates for? Is this something "n8n" does? I've gone to learn more about it, and it describes itself as an "AI-native workflow automation" tool. What the f** is that meant to actually mean?

themgt 2y ago

On one of my sites, I needed to install a form with file upload capability. Soo ... the file upload is happening via JSON webhook? Seems like this was defined as the scope and then file upload was just never mentioned again.

jpm_sd 2y ago

Makes me miss the bad old days of Perl scripts and cgi-bin directories... It was, at least, simple.

pembrook 2y ago

It seems like an extremely convoluted way to receive what will pretty much exclusively be automated spam submissions since I’m not seeing any protection methods mentioned. Attacks on any form on the open web have gotten absurdly bad in recent years — hope the author is using something like Cloudflare + captcha.

deleted 2y ago

[deleted]

devmor 2y ago

Jesus, I can't believe I'm saying this in 2024 but just use a php script and an sqlite file.

pentagrama 2y ago

A fully self hosted solution that for me is good enough and more easy is a WordPress site with the plugin WPforms (free version). No third party services used. Update: not sure if the WPforms free version supports file uploads as the OP needs.

omnimus 2y ago
This is imho wrong approach. Wordpress gives you extremely flexible possibilities but its hard to maintain. Like you really need to keep it updated or you will get hacked (every wp security hole gets hyper targeted). That means trust plugin authors they will keep up to date. WP is suited for smaller/mid businesses that keep it maintained but its not hands off. Coding php/symfony form by hand (if you can do it) might be security through obscurity but realistically it will probably just work for a decade without issues or maintenance.