PHP User Input (HTML Forms)

A web form is like a paper sign-up sheet: visitors fill in the blanks and hand it in. PHP is the person at the desk who reads what they wrote and decides what to do with it.

In this page:

HTML Forms and PHP
Handling Simple Form Text
Checking if Form is Submitted
Form Input Sanitization
Default Values for Missing Inputs

Syntax

php

<form action="script.php" method="POST">
    <input type="text" name="field_name">
    <button type="submit">Send</button>
</form>

<?php
if (isset($_POST["field_name"])) {
    echo $_POST["field_name"];
}
?>

HTML Forms and PHP

When an HTML <form> is submitted, the browser packages every named input's value and sends it to whatever URL the form's action attribute points to, using the method the form specifies (GET or POST).

PHP running at that URL then reads the submitted values out of the corresponding superglobal array.

Example: HTML Forms and PHP

php

<!DOCTYPE html>
<html>
<body>
<form action="process.php" method="POST">
  <input type="text" name="username">
</form>
<?php
// PHP reads the submitted value from $_POST['username']
?>
</body>
</html>

Handling Simple Form Text

$_POST and $_GET are associative arrays where each key matches an HTML input's name attribute.

In a live form, PHP populates these automatically per request; while learning, it's normal to simulate a submission by manually assigning values into $_POST so you can test the handling logic without a browser.

Example: Handling Simple Form Text

php

<?php
// Simulating a form submission for testing
$_POST['username'] = "Alice";
echo $_POST['username'];
?>

Checking if Form is Submitted

Reading $_POST[email] when no form was actually submitted triggers an 'undefined array key' warning.

Checking isset($_POST[email]) first, or inspecting $_SERVER[REQUEST_METHOD], lets your script safely distinguish a genuine submission from a first-time page visit.

Example: Checking if Form is Submitted

php

<?php
// Check whether `isset($_POST['email'])`
if (isset($_POST['email'])) {
    // Print `"Form submitted with: " . $_POST['email']` to the output
    echo "Form submitted with: " . $_POST['email'];
// Otherwise, run this branch
} else {
    // Print "No form submitted yet." to the output
    echo "No form submitted yet.";
}
?>

Form Input Sanitization

Any value from $_GET, $_POST, or $_COOKIE originates outside your control and must be treated as untrusted.

Passing raw input into HTML output without htmlspecialchars() lets an attacker inject a <script> tag that runs in another user's browser — a classic Cross-Site Scripting (XSS) vulnerability.

Example: Form Input Sanitization

php

<?php
// Set `$_POST['comment']` to "<script>alert('xss')</script>"
$_POST['comment'] = "<script>alert('xss')</script>";
// Print `htmlspecialchars($_POST['comment'])` to the output
echo htmlspecialchars($_POST['comment']);
?>

Default Values for Missing Inputs

Accessing a form key that was never submitted (an unchecked checkbox, say) throws a warning rather than quietly returning nothing.

$_POST[newsletter] ?? false sidesteps that by falling back to a sensible default the moment the key is missing, no isset() check required.

Example: Default Values for Missing Inputs

php

<?php
// Declare `$newsletter`, set to `$_POST['newsletter'] ?? false`
$newsletter = $_POST['newsletter'] ?? false;
// Print a detailed dump (with types) of `$newsletter`
var_dump($newsletter);
?>

Chapter Quiz — Complete all 8 topics to unlock

0/8 topics done

Complete these topics first:

← Previous Lesson PHP var_dump & print_r Next Lesson → PHP Superglobals