PHP Form Handling

In PHP, handling forms involves collecting user input through $_GET, $_POST, or $_REQUEST. Let’s explore how to create forms and process form data securely with PHP!

🔹 Creating a Simple Form in HTML

First, let’s create a basic HTML form where users can input their name and email:

<form action="process_form.php" method="post">
    Name: <input type="text" name="username"> <br>
    Email: <input type="email" name="email"> <br>
    <input type="submit" value="Submit">
</form>

When the user submits this form, the data will be sent to the process_form.php file using the POST method.

📝 Example 1: Processing Form Data in PHP

Now, let’s process the form data in PHP. We will retrieve the submitted name and email, then display them back to the user:

<?php
if ($_SERVER["REQUEST_METHOD"] == "POST") {
    // Collect form data
    $username = $_POST['username'];
    $email = $_POST['email'];
    
    // Display the collected data
    echo "Hello, $username! Your email is $email.";
}
?>

Try It Now

In this example, after submitting the form, PHP will process the data and display a personalized message with the user’s name and email.

🔹 Validating Form Data

It’s important to validate and sanitize the form data to prevent errors and security vulnerabilities. Let’s enhance our form processing by adding some basic validation for empty fields:

<?php
if ($_SERVER["REQUEST_METHOD"] == "POST") {
    // Collect form data
    $username = $_POST['username'];
    $email = $_POST['email'];
    
    // Validate input
    if (empty($username) || empty($email)) {
        echo "Both fields are required!";
    } else {
        echo "Hello, $username! Your email is $email.";
    }
}
?>

Try It Now

This example checks if the username and email fields are empty and provides feedback if either field is missing.

🔹 Sanitizing User Input

To further enhance security, it’s important to sanitize user input. This helps protect against malicious code and ensures that the data is safe to use. Here’s how you can sanitize the data using the filter_var() function:

<?php
if ($_SERVER["REQUEST_METHOD"] == "POST") {
    // Collect and sanitize form data
    $username = htmlspecialchars($_POST['username']);
    $email = filter_var($_POST['email'], FILTER_SANITIZE_EMAIL);
    
    // Validate sanitized input
    if (empty($username) || empty($email)) {
        echo "Both fields are required!";
    } else {
        echo "Hello, $username! Your sanitized email is $email.";
    }
}
?>

Try It Now

The htmlspecialchars() function helps prevent XSS attacks by converting special characters to HTML entities. The filter_var() function with FILTER_SANITIZE_EMAIL ensures the email is safe.

🔹 Handling Form Data with $_GET (Alternative Method)

You can also handle form data using the $_GET superglobal, though it’s typically used for non-sensitive data like search queries. Here’s an example using $_GET instead of $_POST:

<?php
if ($_SERVER["REQUEST_METHOD"] == "GET") {
    // Collect form data
    $username = $_GET['username'];
    $email = $_GET['email'];
    
    // Validate input
    if (empty($username) || empty($email)) {
        echo "Both fields are required!";
    } else {
        echo "Hello, $username! Your email is $email.";
    }
}
?>

Try It Now

This example shows how to use the GET method to handle form data. While GET is suitable for non-sensitive data, use POST for sensitive data like passwords.

🎯 Important Security Tips:

  • Always validate and sanitize user input to prevent malicious code and ensure data integrity.
  • Never trust user input directly. Always perform checks and use built-in PHP functions like htmlspecialchars() and filter_var() for security.
  • Consider using CAPTCHA on your forms to prevent spam and bot submissions.

📝 Practice Time!

Modify the form to accept more fields, like a phone number or address. Try adding extra validations like checking for valid email format and minimum password length!