Learning Objectives
After completing this tutorial, you will be able to:
• Understand how HTML forms interact with PHP.
• Process user input using the GET and POST methods.
• Understand the differences between GET and POST.
• Validate user input before processing.
• Use PHP superglobal variables effectively.
• Build secure and user-friendly web forms.
Introduction
Most PHP applications communicate with users through web forms. Whether users register for an account, log in, search for information, submit feedback, or place an online order, they interact with HTML forms.
When a form is submitted, the browser sends data to the web server, where PHP receives, validates, and processes the information. If user input is not properly validated, it can lead to incorrect data, application errors, or security vulnerabilities.
In this tutorial, you will learn how to create HTML forms, process form data using GET and POST methods, validate user input, and use PHP superglobals to access information provided by users and the web server.
Prerequisites
Before starting this tutorial, you should understand:
• Variables
• Data types
• Conditional statements
• Functions
• Basic HTML
What is an HTML Form?
An HTML form collects information from users and sends it to a PHP script for processing.
Example:
<!DOCTYPE html>
<html>
<head>
<title>Student Form</title>
</head>
<body>
<form action="process.php" method="get">
Name: <input type="text" name="studentName">
<br><br>
<input type="submit" value="Submit">
</form>
</body>
</html>
The action attribute specifies the PHP file that will process the form.
The method attribute specifies how data will be transmitted.
GET Method
The GET method sends form data through the URL.
Example URL
http://localhost/form/process.php?studentName=Rahim
Example:
<form action="process.php" method="get">
Name: <input type="text" name="studentName">
<input type="submit">
</form>
Retrieve the value using PHP.
<?php
echo $_GET["studentName"];
?>
Advantages of GET
• Simple to use
• Useful for searching
• Data can be bookmarked
Disadvantages of GET
• Data is visible in the URL
• Limited amount of data
• Not suitable for passwords or sensitive information
POST Method
The POST method sends data inside the HTTP request body.
The submitted information does not appear in the browser address bar.
Example:
<form action="process.php" method="post">
Name: <input type="text" name="studentName">
<input type="submit">
</form>
Retrieve the value.
<?php
echo $_POST["studentName"];
?>
Advantages of POST
• More secure than GET
• Suitable for passwords
• Supports larger amounts of data
• Used for registration and login systems
GET vs POST
|
Feature |
GET |
POST |
|---|---|---|
| Data Location | URL | Request Body |
| Visible in Browser | Yes | No |
| Security | Lower | Higher |
| Bookmark Supported | Yes | No |
| Suitable for Passwords | No | Yes |
Self-Processing Form
A self-processing form submits data to the same PHP file.
Example:
<?php
if($_SERVER["REQUEST_METHOD"]=="POST")
{
echo "Welcome " . $_POST["name"];
}
?>
<!DOCTYPE html>
<html>
<body>
<form method="post">
<input type="text" name="name">
<input type="submit">
</form>
</body>
</html>
Input Validation
Validation checks whether user input is correct before processing.
Common validation includes:
• Required fields
• Email validation
• Numeric validation
• Password validation
• Input length
• Character validation
Required Field Validation
Example:
<?php
if(empty($_POST["name"]))
{
echo "Name is required.";
}
else
{
echo "Welcome " . $_POST["name"];
}
?>
Email Validation
PHP provides filter_var() for validating email addresses.
Example:
<?php
$email = $_POST["email"];
if(filter_var($email, FILTER_VALIDATE_EMAIL))
{
echo "Valid Email";
}
else
{
echo "Invalid Email";
}
?>
Numeric Validation
Example:
<?php
$age = $_POST["age"];
if(is_numeric($age))
{
echo "Valid Age";
}
else
{
echo "Please enter a number.";
}
?>
String Length Validation
Example:
<?php
$password = $_POST["password"];
if(strlen($password) >= 8)
{
echo "Strong Password";
}
else
{
echo "Password is too short.";
}
?>
Sanitizing User Input
Validation checks correctness.
Sanitization removes unwanted or dangerous characters.
Example:
<?php $name = htmlspecialchars($_POST["name"]); echo $name; ?>
The htmlspecialchars() function helps prevent Cross-Site Scripting (XSS) attacks by converting special HTML characters into safe text.
PHP Superglobals
Superglobals are predefined variables that are available throughout every PHP script.
Common superglobals include:
• $_GET
• $_POST
• $_REQUEST
• $_SERVER
• $_FILES
• $_COOKIE
• $_SESSION
• $_ENV
• $GLOBALS
The $_GET Superglobal
Stores data submitted through the GET method.
Example:
<?php echo $_GET["city"]; ?>
The $_POST Superglobal
Stores data submitted through the POST method.
Example:
<?php echo $_POST["username"]; ?>
The $_REQUEST Superglobal
Contains data from both GET and POST requests.
Example:
<?php echo $_REQUEST["student"]; ?>
The $_SERVER Superglobal
Provides information about the web server and current request.
Example:
<?php echo $_SERVER["PHP_SELF"]; ?>
Display the request method.
<?php
echo $_SERVER[“REQUEST_METHOD”];
?>
Display the visitor’s IP address.
<?php
echo $_SERVER[“REMOTE_ADDR”];
?>
Example 1
Student Registration Form
<!DOCTYPE html>
<html>
<body>
<form action="register.php" method="post">
Name:
<input type="text" name="name">
<br><br>
Email:
<input type="email" name="email">
<br><br>
Age:
<input type="number" name="age">
<br><br>
<input type="submit" value="Register">
</form>
</body>
</html>
Process the form.
<?php $name = htmlspecialchars($_POST["name"]); $email = $_POST["email"]; $age = $_POST["age"]; echo "Name: ".$name."<br>"; echo "Email: ".$email."<br>"; echo "Age: ".$age; ?>
Example 2
Simple Login Form
<?php
$username = $_POST["username"];
$password = $_POST["password"];
if($username=="admin" && $password=="12345")
{
echo "Login Successful";
}
else
{
echo "Invalid Username or Password";
}
?>
Example 3
Check Request Method
<?php
if($_SERVER["REQUEST_METHOD"]=="POST")
{
echo "Form Submitted";
}
?>
Example 4
Search Form Using GET
<form action="" method="get">
<input type="text" name="keyword">
<input type="submit" value="Search">
</form>
<?php
if(isset($_GET["keyword"]))
{
echo "Searching for: ".$_GET["keyword"];
}
?>
Example 5
Validate Multiple Fields
<?php
if(empty($_POST["name"]))
{
echo "Name is required.";
}
elseif(empty($_POST["email"]))
{
echo "Email is required.";
}
else
{
echo "Registration Successful";
}
?>
Lab Activities
Task 1
Create a student registration form using the POST method.
Task 2
Create a search form using the GET method.
Task 3
Validate that the student name is not empty, validate an email address using filter_var(), validate that age contains only numbers.
Task 4
Display the current request method.
Exercises:
- Build a student admission form that validates all required fields.
- Develop a BMI calculator using an HTML form and PHP.
- Build a grade calculator that accepts marks for five subjects and calculates the CGPA.
- Create a profile update form that sanitizes all user input before displaying it.