html - Response.Write with an iframe -

i have inherited application uses cybersource credit card processing company. uses cybersource api , trying convert use hosted order page - silent order post method. example cybersource gives run follows:

<form action="https://orderpagetest.ic3.com/hop/processorder.do" method="post">     <% insertsignature3("10", "usd", "sale"); %>         <h2>payment information</h2>         card type:      <select name="card_cardtype"><br>                             <option value="">                             <option value="001">visa                             <option value="002">mastercard                             <option value="003">american express                         </select><br>         card number:        <input type="text" name="card_accountnumber"><br>         expiration month:   <input type="text" name="card_expirationmonth"> (mm)<br>         expiration year:    <input type="text" name="card_expirationyear"> (yyyy)<br><br>      <h2>ready check out!</h2>                             <input type="submit" name="submit" value="buy now">  </form> 

the code insertsignature method follows:

 public void insertsignature3( string amount, string currency, string orderpage_transactiontype )     {         try         {             timespan timespantime = datetime.utcnow - new datetime( 1970, 1, 1 );             string[] arraytime = timespantime.totalmilliseconds.tostring().split( '.' );             string time = arraytime[0];             string merchantid = getmerchantid();             if ( merchantid.equals( "" ) )                 response.write( "<b>error:</b> <br>the current security script (hop.cs) doesn't contain merchant information. please login <a href='https://ebc.cybersource.com/ebc/hop/hopsecurityload.do'>cybersource business center</a> , generate 1 before proceeding further. sure replace existing hop.cs newly generated hop.cs.<br><br>" );             string data = merchantid + amount + currency + time + orderpage_transactiontype;             string pub = getsharedsecret();             string serialnumber = getserialnumber();             byte[] bytedata = system.text.encoding.utf8.getbytes( data );             byte[] bytekey = system.text.encoding.utf8.getbytes( pub );             hmacsha1 hmac = new hmacsha1( bytekey );             string publicdigest = convert.tobase64string( hmac.computehash( bytedata ) );             publicdigest = publicdigest.replace( "\n", "" );             system.text.stringbuilder sb = new system.text.stringbuilder();             sb.append( "<input type=\"hidden\" name=\"amount\" value=\"" );             sb.append( amount );             sb.append( "\">\n<input type=\"hidden\" name=\"currency\" value=\"" );             sb.append( currency );             sb.append( "\">\n<input type=\"hidden\" name=\"orderpage_timestamp\" value=\"" );             sb.append( time );             sb.append( "\">\n<input type=\"hidden\" name=\"merchantid\" value=\"" );             sb.append( merchantid );             sb.append( "\">\n<input type=\"hidden\" name=\"orderpage_transactiontype\" value=\"" );             sb.append( orderpage_transactiontype );             sb.append( "\">\n<input type=\"hidden\" name=\"orderpage_signaturepublic\" value=\"" );             sb.append( publicdigest );             sb.append( "\">\n<input type=\"hidden\" name=\"orderpage_version\" value=\"4\">\n" );             sb.append( "<input type=\"hidden\" name=\"orderpage_serialnumber\" value=\"" );             sb.append( serialnumber );             sb.append( "\">\n" );             response.write( sb.tostring() );         }         catch ( exception e )         {             response.write( e.stacktrace.tostring() );         }     } 

everything works when run in test application. however, cannot use form tag in main application master page has enclosed in form tag , result in nested form tag. have tried putting form block in iframe cannot work out how pass additional information via response.write call insertsignature(...) method.

any suggestions appreciated.

i went through same issue. went iframe approach. on page load (if postback) want write out specific items in request (excluding viewstate). example below shows writing out items (except viewstate). wrapped in ccinfo span can through javascript.

protected virtual void page_load(object sender, eventargs e) {      if (!page.ispostback)     {         //do page binding, etc needs done on intitial page load     }     else     {         //we came cybersource ...          //will need stored client hidden field ...         string decision = request.form["decision"];          if (verifytransactionsignature(request))         {             //make sure processing in test environment if particular setting             //is set test (site_settings.cybersource_api_url contains 'test' in it)             string apiurl = settings.getsetting(localconnectionstring, "cybersource_api_url");             //api isn't test, cybersource (someone hacking?)             if (!apiurl.tolower().contains("test") && request.form["orderpage_environment"].tolower().contains("test"))             {                 lblerror.text = "unable verify credit card. request in test mode, site not.  contact customer service.";             }              response.write("<span class='ccinfo hide'>");             (int = 0; < request.form.count; i++)             {                 var key = request.form.getkey(i);                  if (key != "__viewstate")                 {                     response.write("<input type='hidden' id='" + key + "' name='" + key + "' value='" + request.form[i] + "' class='hide' />");                 }             }             response.write("</span>");              if (decision != "accept")             {                 string reasoncode = request.form["reasoncode"];                  lblerror.text = "unable verify credit card (" + reasoncode + ") ";                 if (reasoncode == "102")                 {                     lblerror.text += "<br />one or more fields in request contains invalid data.  typically expiration date";                 }             }         }         else         {             lblerror.text = "unable verify credit card. transaction signature not valid.  contact customer service.";         }     } } 

the javascript use data send parent page follows:

$(document).ready(function () {     var decision = $('#decision');      if (decision.length > 0) {         if (decision.val() === "accept") {             //pass in requestid, etc billing page             parent.$('.checkoutform').append($('.ccinfo').children());              //call billing.aspx submit function             parent.submitbillingpage();              return;         } else {             //change loading animation iframe             parent.toggleiframe(true);         }     } }); 

the parent page has "checkoutform" class name can append of elements of ccinfo span in our iframe. 1 liner shoves of elements wrote out using our server side code parent page. parent page has of information came cybersource.

our billing page (the parent page) allows other payments besides cybersource credit card, submit on main page assuming came cybersource successfully. display main submit button on billing page when user isn't paying cybersource. if are, hide main submit button , submit button in iframe displayed instead. either display error messages in iframe if went wrong or form submit on parent page after transferring data iframe parent page.

finally, parent page has access of data through server side code looking @ request.form.

hopefully helps or @ least gets going in right direction. know question on month old , may have moved on, maybe else down line.