GET and POST: Handling Form Data

1. The Form Handling Process: An Overview

Before diving into the code, let's look at the big picture. A user fills out an HTML form and clicks "submit." The browser then packages the data and sends it to a web server where your PHP script lives. Your script receives the data and can then do something with it, like saving it to a database or displaying it back to the user.

The two key components of the HTML <form> tag that control this process are the action and method attributes:

• action: Specifies the URL of the PHP script that will process the form data.
• method: Specifies the HTTP method to use when sending the data. The two most common methods are GET and POST.

2. The POST Method: Secure and Robust

The POST method is the standard choice for most forms, especially those involving sensitive information like passwords or personal details. When you use POST, the form data is sent in the body of the HTTP request, meaning it's not visible in the browser's URL bar.

When a form is submitted via POST, PHP automatically populates a special superglobal variable called $_POST. This variable is an associative array, where the keys are the name attributes of your form's input fields, and the values are the data entered by the user. This is a direct application of what we learned in the last lesson!

To see how this works, let's watch a short video that introduces the POST method.

As you saw, using POST keeps user data hidden from the URL, which is a fundamental security practice.

3. The GET Method: Data in the URL

The GET method works differently. It bundles the form data into a query string and appends it directly to the URL specified in the action attribute.

http://example.com/search.php?term=php&category=tutorials

While this makes the data visible (and therefore insecure for sensitive information), it's useful for things like search queries or filter settings, where you might want the user to be able to bookmark or share the URL with the parameters included.

When a form is submitted using GET, PHP populates the $_GET superglobal associative array.

When to Use GET vs. POST

4. Secure Form Processing: A Step-by-Step Guide

Simply grabbing data from $_POST and using it is dangerous. Your highest priority when handling user input is security. You must assume all user data is potentially malicious. Let's walk through the essential steps to process form data securely.

This next video is incredibly valuable. It covers not just how to handle form data, but how to do it safely.

Let's summarize those crucial security steps:

1. Verify the Request Method: Always wrap your processing logic in a condition to ensure the data was sent using the expected method. This prevents users from accessing your processing script directly.

   if ($_SERVER["REQUEST_METHOD"] == "POST") {
       // Process form data here...
   }
   

2. Validate on the Server: Never trust client-side validation. As the video showed, it can be easily bypassed. Always re-validate the data on the server. A simple first step is checking if required fields are empty.

   if (empty($_POST["username"])) {
       // Handle the error - username is required.
   }
   

3. Sanitize for Output: To prevent Cross-Site Scripting (XSS), where an attacker injects malicious scripts into your webpage, you must escape any user-provided data before you display it. The htmlspecialchars() function is your primary tool for this.

   $username = htmlspecialchars($_POST["username"]);
   echo "Welcome, " . $username; // Now it's safe to display
   

<?php
if ($_SERVER["REQUEST_METHOD"] == "POST") {
    $comment = $_POST['comment_text'];
    echo "<div class='comment'>" . $comment . "</div>";
}
?>

<?php
if ($_SERVER["REQUEST_METHOD"] == "POST") {
    $comment_text = htmlspecialchars($_POST['comment_text']);
    echo "<div class='comment'>" . $comment_text . "</div>";
}
?>

5. Redirecting After Submission

After successfully processing a form (e.g., saving data to a database), it's bad practice to leave the user on the processing script page. If they refresh the page, the browser might try to resubmit the form data.

The standard solution is to redirect the user to another page (like a "thank you" page or back to the homepage) using the header() function.

Important Note: You must call the header() function before any HTML or echo output is sent to the browser.

Conclusion

You have now learned one of the most practical and essential skills in PHP. By understanding how to handle form data, you've unlocked the ability to create interactive web applications that respond to user input.

Key Takeaways:

• HTML forms use action to specify a processing script and method (GET or POST) to define how data is sent.
• The POST method is the standard for submitting data, as it's more secure and has no size limit. Data is available in the $_POST associative array.
• The GET method sends data in the URL and is suitable for non-sensitive data like search queries. Data is available in the $_GET array.
• Security is paramount: Always verify the request method, validate input on the server, and sanitize output with htmlspecialchars() to prevent XSS attacks.
• Use header('Location: ...') to redirect users after a successful form submission to prevent duplicate submissions.

In our next lesson, we will learn about including and requiring PHP files. This will allow us to separate our HTML form markup from our PHP processing logic, a crucial step towards organizing your code for larger projects and building a clean application architecture.