Tutorials PHP Handling Forms

PHP Fundamentals

Introduction to PHP Variables & Data Types

Strings & Numbers

String Functions Math Functions

Control Structures

Conditionals Loops

Arrays

Indexed & Associative Arrays Array Functions

Functions

Functions Anonymous Functions & Closures

Forms & Superglobals

Handling Forms Other Superglobals

File & Database

File Handling MySQL with PHP

OOP in PHP

Classes & Objects Inheritance & Interfaces

PHP Best Practices

Best Practices & Security

PHP Intermediate FREE

Handling Forms

Lesson 1 of 17 Intermediate Interactive

PHP makes it easy to handle form submissions from HTML forms. When a form is submitted, the data becomes available in PHP superglobal variables.

GET vs POST

$_GET — Data from URL query parameters (visible in URL)
$_POST — Data from form submissions using POST method (not visible in URL)
$_REQUEST — Contains both GET and POST data

Form Handling Steps

Create the HTML form with method="POST"
Process data with PHP when the form is submitted
Validate the input (check if it meets requirements)
Sanitize the input (remove harmful characters)

Tip: Always validate and sanitize user input to prevent security vulnerabilities like XSS and SQL injection.

Syntax

PHP

<!-- HTML Form -->
<form action="process.php" method="POST">
    <input type="text" name="name" required>
    <input type="email" name="email" required>
    <button type="submit">Submit</button>
</form>

<?php
// process.php

if ($_SERVER["REQUEST_METHOD"] === "POST") {
    $name = htmlspecialchars(trim($_POST["name"] ?? ""));
    $email = filter_var($_POST["email"] ?? "", FILTER_SANITIZE_EMAIL);

    if (empty($name)) {
        echo "Name is required.";
    } elseif (!filter_var($email, FILTER_VALIDATE_EMAIL)) {
        echo "Invalid email.";
    } else {
        echo "Welcome, $name!";
    }
}
?>

Processing HTML Forms

PHP

<?php
$errors = [];

if ($_SERVER["REQUEST_METHOD"] === "POST") {
    $name = trim($_POST["name"] ?? "");
    $email = trim($_POST["email"] ?? "");

    if ($name === "") $errors[] = "Name is required";
    if (!filter_var($email, FILTER_VALIDATE_EMAIL)) {
        $errors[] = "Invalid email";
    }

    if (empty($errors)) {
        echo "Welcome, " . htmlspecialchars($name) . "!
";
        echo "We emailed " . htmlspecialchars($email) . "
";
    } else {
        foreach ($errors as $error) {
            echo "Error: " . $error . "
";
        }
    }
}
?>
<form method="post">
    <input name="name" placeholder="Your name">
    <input name="email" type="email" placeholder="Email">
    <button type="submit">Submit</button>
</form>

Try It Yourself

Practice

Exercise

Create a PHP form handler that validates that both name and email fields are not empty.

Answer

<?php
$name = trim($_POST["name"] ?? "");
$email = trim($_POST["email"] ?? "");

if (empty($name) || empty($email)) {
    echo "Both fields are required.";
} else {
    echo "Welcome, $name!";
}
?>

Exercise

Use filter_var() to validate an email address and display appropriate messages.

Answer

<?php
$email = $_POST["email"] ?? "";
if (filter_var($email, FILTER_VALIDATE_EMAIL)) {
    echo "Valid email: $email";
} else {
    echo "Invalid email address.";
}
?>

Quick Quiz

Which superglobal contains data from a POST form submission?

$_GET

$_POST

$_REQUEST

$_SERVER

$_POST contains data sent via the HTTP POST method, typically from HTML forms.

What does htmlspecialchars() do?

Removes whitespace

Converts special characters to HTML entities

Validates input

Encrypts data

htmlspecialchars() converts characters like < > & " to HTML entities to prevent XSS attacks.

Which filter validates an email address?

FILTER_SANITIZE_EMAIL

FILTER_VALIDATE_EMAIL

FILTER_CHECK_EMAIL

FILTER_VERIFY_EMAIL

FILTER_VALIDATE_EMAIL checks if the value is a valid email address format.

Interview Questions

$_GET data is appended to the URL as query parameters (visible to users), while $_POST data is sent in the request body (not visible in the URL). $_GET is limited in size and should not be used for sensitive data. $_POST is preferred for form submissions that modify data.

Unsanitized input can contain malicious code like SQL injection queries, XSS scripts, or file inclusion attacks. Sanitization removes or escapes harmful characters, while validation ensures data matches expected formats. Together, they protect your application from common security vulnerabilities.

Next Lesson

Other Superglobals