PHP Form Submission

HTML Form Basics

Example:

<form action="process.php" method="post">
    Name: <input type="text" name="name"><br><br>
    Email: <input type="email" name="email"><br><br>
    <input type="submit" value="Submit">
</form>

GET vs POST Methods

Key Notes:

• Use POST for sensitive data (passwords, personal info).
• GET appends data to the URL, visible to users.

Accessing Form Data in PHP

• POST data: $_POST['field_name']
• GET data: $_GET['field_name']

<?php
if ($_SERVER["REQUEST_METHOD"] == "POST") {
    $name = $_POST['name'];
    $email = $_POST['email'];

    echo "Name: $name <br>";
    echo "Email: $email <br>";
}
?>

• $_SERVER["REQUEST_METHOD"] ensures the form was submitted via POST.

Validating Form Data

Validation ensures data is safe and correct before processing:

<?php
if ($_SERVER["REQUEST_METHOD"] == "POST") {
    $name = trim($_POST['name']);   // Remove extra spaces
    $email = trim($_POST['email']);

    // Check if fields are empty
    if (empty($name) || empty($email)) {
        echo "All fields are required!";
    } elseif (!filter_var($email, FILTER_VALIDATE_EMAIL)) {
        echo "Invalid email format!";
    } else {
        echo "Form submitted successfully.<br>";
        echo "Name: $name <br>Email: $email";
    }
}
?>

Notes:

• trim() removes whitespace
• filter_var() validates email, URLs, etc.
• Always validate server-side, even if you have client-side validation.

Preventing XSS (Cross-Site Scripting)

Use htmlspecialchars() to convert special characters:

$name = htmlspecialchars($_POST['name']);
$email = htmlspecialchars($_POST['email']);

This prevents users from injecting malicious scripts.

Sticky Forms (Keep Data After Submission)

<form method="post">
    Name: <input type="text" name="name" value="<?php echo isset($_POST['name']) ? htmlspecialchars($_POST['name']) : ''; ?>"><br><br>
    Email: <input type="email" name="email" value="<?php echo isset($_POST['email']) ? htmlspecialchars($_POST['email']) : ''; ?>"><br><br>
    <input type="submit" value="Submit">
</form>

• Useful when validation fails; the user doesn’t have to retype data.

File Uploads via Forms

<form method="post" enctype="multipart/form-data">
    Select file: <input type="file" name="file"><br><br>
    <input type="submit" name="upload" value="Upload">
</form>

<?php
if(isset($_POST['upload'])){
    $target_dir = "uploads/";
    $target_file = $target_dir . basename($_FILES["file"]["name"]);

    if(move_uploaded_file($_FILES["file"]["tmp_name"], $target_file)){
        echo "File uploaded successfully!";
    } else {
        echo "Error uploading file.";
    }
}
?>

Notes:

• $_FILES['file']['tmp_name'] → Temporary location
• move_uploaded_file() → Move to permanent location
• Always validate file type and size for security

✅ Features of this example:

• Validates all fields
• Displays errors inline
• Prevents XSS attacks using htmlspecialchars()
• Shows success message when submitted

Practice Example: Complete PHP Form Submission