PHP Form Handling

PHP form handling is how your server receives data typed by users, such as contact messages or sign-ups. PHP puts submitted data into the superglobal arrays $_GET and $_POST, which you must validate before trusting.

A Simple HTML Form

The method attribute decides how data is sent. GET puts it in the URL (good for search), POST sends it in the request body (use it for anything that changes data or contains private info).

<form method="post" action="contact.php">
  <input name="name" placeholder="Your name">
  <input name="email" type="email" placeholder="Email">
  <button>Send</button>
</form>

(A form with name and email fields and a Send button)

Reading $_POST Data

Always use ?? because a field may be missing. htmlspecialchars() turns characters like < into safe entities so a user cannot inject scripts (XSS).

<?php
// contact.php
if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    $name = trim($_POST['name'] ?? '');
    $email = trim($_POST['email'] ?? '');
    echo "Thanks, " . htmlspecialchars($name);
}

Thanks, Naeem

PHP Form Validation

Validate every field on the server even if the browser already checks it, because requests can be faked. Collect errors in an array and show them next to the form.

<?php
$data = ['name' => 'A', 'email' => 'not-an-email', 'age' => '17'];
$errors = [];

if (mb_strlen($data['name']) < 2) {
    $errors['name'] = 'Name must be at least 2 characters.';
}
if (!filter_var($data['email'], FILTER_VALIDATE_EMAIL)) {
    $errors['email'] = 'Please enter a valid email.';
}
$age = filter_var($data['age'], FILTER_VALIDATE_INT, ['options' => ['min_range' => 18]]);
if ($age === false) {
    $errors['age'] = 'You must be 18 or older.';
}
print_r($errors);

Array
(
    [name] => Name must be at least 2 characters.
    [email] => Please enter a valid email.
    [age] => You must be 18 or older.
)

Reading $_GET Query Strings

<?php
// search.php?q=laravel&page=2
$q = $_GET['q'] ?? '';
$page = max(1, (int) ($_GET['page'] ?? 1));
echo "Searching for '" . htmlspecialchars($q) . "' on page $page";

Searching for 'laravel' on page 2

Form Security Checklist

• Escape output with htmlspecialchars()
• Validate types, lengths and formats on the server
• Use prepared statements for database queries (see the PDO lesson)
• Protect POST forms with a CSRF token stored in the session
• Redirect after a successful POST (Post/Redirect/Get) to avoid double submits

Frequently asked questions

What is the difference between GET and POST in PHP?

GET sends data in the URL and is for reading or searching. POST sends data in the request body and is for creating or changing data and for sensitive fields.

How do I prevent XSS in PHP?

Escape any user-provided value before printing it into HTML with htmlspecialchars($value, ENT_QUOTES, "UTF-8"). Template engines like Blade do this automatically.

How do I validate an email in PHP?

Use filter_var($email, FILTER_VALIDATE_EMAIL), which returns the email if valid or false if not.