PHP Form Handling

Form handling is PHP receiving what a visitor typed into a web form and doing something useful with it. It is like a receptionist who reads each filled-in card and passes it on.

In this page:

Handling GET Forms
Handling POST Forms
Validating Form Submission
Processing Multi-value Inputs
Checking Empty Inputs

Syntax

php

if ($_SERVER["REQUEST_METHOD"] === "POST") {
    $value = $_POST["field_name"];
}

$value = $_GET["field_name"];

Handling GET Forms

An HTML form's data arrives in PHP through the $_GET or $_POST superglobal array, depending on the form's method attribute, with each array key matching the corresponding input field's name attribute.

Example: Handling GET Forms

php

<?php
// Set `$_GET['search']` to "php tutorials"
$_GET['search'] = "php tutorials";
// Print `$_GET['search']` to the output
echo $_GET['search'];
?>

Handling POST Forms

Checking $_SERVER[REQUEST_METHOD] === POST at the top of a script is the standard way to detect whether the form was actually submitted, versus the page just being loaded normally for the first time.

Example: Handling POST Forms

php

<?php
// Set `$_SERVER['REQUEST_METHOD']` to 'POST'
$_SERVER['REQUEST_METHOD'] = 'POST';
// Check whether `$_SERVER['REQUEST_METHOD'] === 'POST'`
if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    // Print "Form was submitted" to the output
    echo "Form was submitted";
// Otherwise, run this branch
} else {
    // Print "Just a normal page load" to the output
    echo "Just a normal page load";
}
?>

Validating Form Submission

Every value coming from $_POST or $_GET should be treated as untrusted user input — always validate its type and content before using it in a database query, a file path, or displayed HTML.

Example: Validating Form Submission

php

<?php
// Set `$_POST['age']` to "25"
$_POST['age'] = "25";
// Declare `$age`, set to `$_POST['age']`
$age = $_POST['age'];
// Check whether `is_numeric($age) && $age > 0`
if (is_numeric($age) && $age > 0) {
    // Print "Valid age: $age" to the output
    echo "Valid age: $age";
}
?>

Processing Multi-value Inputs

htmlspecialchars() should wrap any user-submitted value before it's echoed back into HTML, preventing a malicious script tag typed into a form field from executing in another visitor's browser (cross-site scripting).

Example: Processing Multi-value Inputs

php

<?php
// Set `$_POST['comment']` to "<script>alert('xss')</script>"
$_POST['comment'] = "<script>alert('xss')</script>";
// Print `htmlspecialchars($_POST['comment'])` to the output
echo htmlspecialchars($_POST['comment']);
?>

Checking Empty Inputs

Redirecting after a successful form submission (the Post/Redirect/Get pattern) prevents the browser from resubmitting the same form data if the user refreshes the resulting page.

Example: Checking Empty Inputs

php

<?php
// After a successful POST, redirecting avoids duplicate submissions on refresh
$submitted = true;
if ($submitted) {
    echo "header('Location: /thank-you.php'); // Post/Redirect/Get pattern";
}
?>

Chapter Quiz — Complete all 8 topics to unlock

0/8 topics done

Complete these topics first:

← Previous Lesson PHP Directory Functions Next Lesson → PHP Form Validation