PHP · Theory

Form Handling

Theory

41/352

Form Handling

An HTML form POSTs to a PHP file. <form method='post' action='save.php'> then in save.php: $name = $_POST['name'] ?? ''; Never trust it — trim, check empty, htmlspecialchars when you print back.

GET puts data in the URL (?name=Asha) — $_GET. Use POST for passwords and saves. After a successful POST, redirect (PRG) so refresh doesn’t save twice.

Trap — putting $_POST straight into SQL. Use prepared statements. Trap: printing $_POST into HTML without escape (XSS).

Diagram

  Browser
      │ POST / GET
      ▼
   .php file
      │
      ▼
   HTML back

Exam tip

$_POST['name'] after a form. Validate + htmlspecialchars.

Example

<?php
// $name = $_POST["name"] ?? "";
$name = "Asha"; // demo input
$name = htmlspecialchars($name, ENT_QUOTES, "UTF-8");
echo "Hello, $name";

Form Handling — read request data carefully and escape output to prevent XSS.

Short notes

DefForms → $_POST or $_GET.
RuleValidate. Escape output. POST for secrets.
TrapSQL concat. XSS.

PHP · Theory

Form Handling

← All stacks

Theory

41/352

Form Handling

An HTML form POSTs to a PHP file. <form method='post' action='save.php'> then in save.php: $name = $_POST['name'] ?? ''; Never trust it — trim, check empty, htmlspecialchars when you print back.

GET puts data in the URL (?name=Asha) — $_GET. Use POST for passwords and saves. After a successful POST, redirect (PRG) so refresh doesn’t save twice.

Trap — putting $_POST straight into SQL. Use prepared statements. Trap: printing $_POST into HTML without escape (XSS).

Diagram

  Browser
      │ POST / GET
      ▼
   .php file
      │
      ▼
   HTML back

Exam tip

$_POST['name'] after a form. Validate + htmlspecialchars.

Example

<?php
// $name = $_POST["name"] ?? "";
$name = "Asha"; // demo input
$name = htmlspecialchars($name, ENT_QUOTES, "UTF-8");
echo "Hello, $name";

Form Handling — read request data carefully and escape output to prevent XSS.

Short notes

DefForms → $_POST or $_GET.
RuleValidate. Escape output. POST for secrets.
TrapSQL concat. XSS.

Form Handling

Example

Short notes

Questions

Form Handling

Example

Short notes

Questions