Handling form data in PHP

A form collects user input in the browser and sends it to a PHP script on the server, which reads the values through the superglobals $_GET` and `$_POST.

1. Creating the HTML form

<form action="process.php" method="post">
  Name:  <input type="text"  name="username" required><br>
  Email: <input type="email" name="email"    required><br>
  <input type="submit" value="Submit">
</form>

2. The action and method attributes

• action: the URL of the script that receives and processes the data (process.php). If empty, it submits to the same page.
• method: how data is sent, either get or post.
• Each input's name attribute becomes the key in the PHP array.

3. GET vs POST

Basis	GET	POST
Data location	Appended to the URL as a query string (?username=Ali&email=a@b.com)	Sent in the HTTP request body
Visibility	Visible, bookmarkable	Hidden from the URL
Size limit	Limited by URL length	Practically large
Security	Not for passwords or sensitive data	Better, but still needs HTTPS
Use	Search, filters, idempotent reads	Login, registration, uploads, data changes
PHP array	$_GET['name']` | `$_POST['name']

$_REQUEST holds both GET and POST (and cookie) data.

4. Complete example

form.html

<form action="process.php" method="post">
  Name:  <input type="text"  name="username"><br>
  Email: <input type="email" name="email"><br>
  <input type="submit" value="Register">
</form>

process.php

<?php
if ($_SERVER["REQUEST_METHOD"] === "POST") {
    // 1. Check that fields exist
    $name  = isset($_POST["username"]) ? trim($_POST["username"]) : "";
    $email = isset($_POST["email"])    ? trim($_POST["email"])    : "";

    // 2. Validate
    if ($name === "" || !filter_var($email, FILTER_VALIDATE_EMAIL)) {
        echo "Please enter a valid name and email.";
    } else {
        // 3. Sanitize output to prevent XSS
        echo "Welcome, " . htmlspecialchars($name) . "<br>";
        echo "Your email: " . htmlspecialchars($email);
    }
}
?>

GET example: search.php?q=php is read with $q =$_GET['q'] ?? '';

Form submission process

1. The user fills and submits the form.
2. The browser sends a request to the action URL using the chosen method.
3. PHP receives the data in $_POST`/`$_GET.
4. The script validates and sanitizes it (trim, filter_var, htmlspecialchars), then processes it (store in a database, send email).
5. It returns a response page (or redirects with header('Location: ...')).

Good practices: always validate on the server (client-side checks can be bypassed), use prepared statements for database queries, and use HTTPS for sensitive data.