PHP — Forms

GET method

<!-- form.html -->
<form action="process.php" method="GET">
    <input type="text" name="name">
    <input type="email" name="email">
    <button type="submit">Submit</button>
</form>

<?php
// process.php
if ($_SERVER['REQUEST_METHOD'] === 'GET') {
    $name = htmlspecialchars($_GET['name'] ?? '');
    $email = htmlspecialchars($_GET['email'] ?? '');

    echo "Name: $name, Email: $email";
}
?>

POST method

<?php
if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    $name = htmlspecialchars($_POST['name'] ?? '');
    $email = htmlspecialchars($_POST['email'] ?? '');

    // Validate
    $errors = [];
    if (empty($name)) $errors[] = "Name is required";
    if (!filter_var($email, FILTER_VALIDATE_EMAIL)) {
        $errors[] = "Invalid email";
    }

    if (empty($errors)) {
        // Process form
        echo "Form submitted successfully!";
    } else {
        foreach ($errors as $error) {
            echo "<p>$error</p>";
        }
    }
}
?>

File upload

<?php
if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    $file = $_FILES['avatar'];

    // Check for errors
    if ($file['error'] === UPLOAD_ERR_OK) {
        $allowed = ['image/jpeg', 'image/png', 'image/gif'];

        if (in_array($file['type'], $allowed)) {
            $newName = uniqid() . '.' . pathinfo($file['name'], PATHINFO_EXTENSION);
            move_uploaded_file($file['tmp_name'], "uploads/$newName");
            echo "File uploaded: $newName";
        } else {
            echo "Invalid file type";
        }
    }
}
?>

CSRF protection

<?php
session_start();

// Generate token
if (!isset($_SESSION['csrf_token'])) {
    $_SESSION['csrf_token'] = bin2hex(random_bytes(32));
}
?>

<form method="POST">
    <input type="hidden" name="csrf_token" value="<?= $_SESSION['csrf_token'] ?>">
    <!-- form fields -->
</form>

<?php
// Validate token
if ($_POST['csrf_token'] !== $_SESSION['csrf_token']) {
    die("Invalid CSRF token");
}
?>

Mini Practice

Write PHP code that:

1. Processes a GET form
2. Validates POST form data
3. Handles file uploads
4. Implements CSRF protection

Up Next

In the next lesson, you'll learn about Database — connecting to databases with PHP.