Handling HTML Forms in PHP: Methods, Controls & Validation

Study Deep: Form Security Best Practices

When handling forms in a University exam or professional project, security is as important as functionality.

1. Cross-Site Scripting (XSS) Prevention: Always use htmlspecialchars() when displaying user-submitted data to prevent malicious scripts from executing in the browser.
2. CSRF Protection: Use hidden tokens to ensure that form submissions originate from your own site.
3. Empty Field Checks: Never assume a user will fill out all fields. Always use empty() or isset() before processing.
4. Data Sanitization: Use trim() to remove accidental whitespace and stripslashes() to clean up data.

1. What is an HTML Form?

An HTML Form is a section of a web page that contains interactive controls (text boxes, checkboxes, buttons, etc.) allowing users to input data and submit it to a web server for processing.

Key Form Attributes:

2. Form Handling Process (Step-by-Step)

1. Design: HTML form is created with appropriate input controls.
2. User Input: The user fills in the form fields in the browser.
3. Submission: User clicks the Submit button.
4. HTTP Request: The browser packages the form data and sends it to the server URL specified in action.
5. PHP Processing: The PHP script reads values from $_GET or $_POST.
6. Validation: PHP checks that the data is correct and complete.
7. Response: After processing (saving, emailing, etc.), PHP sends back an HTML response page.

3. GET vs POST Methods — Detailed Comparison

4. A Complete Form Example

HTML File (form.html):

<form method="POST" action="process.php">
  <label>Name:</label>
  <input type="text" name="fname" placeholder="Enter your name"><br>

  <label>Email:</label>
  <input type="email" name="email" placeholder="Enter email"><br>

  <label>Gender:</label>
  <input type="radio" name="gender" value="Male"> Male
  <input type="radio" name="gender" value="Female"> Female<br>

  <label>Skills:</label>
  <input type="checkbox" name="skills[]" value="PHP"> PHP
  <input type="checkbox" name="skills[]" value="JavaScript"> JS<br>

  <label>City:</label>
  <select name="city">
    <option value="Delhi">Delhi</option>
    <option value="Mumbai">Mumbai</option>
  </select><br>

  <textarea name="message" placeholder="Your message..."></textarea><br>
  <input type="submit" value="Submit">
</form>

PHP File (process.php):

<?php
if ($_SERVER["REQUEST_METHOD"] == "POST") {
  $name   = htmlspecialchars($_POST['fname']);
  $email  = htmlspecialchars($_POST['email']);
  $gender = $_POST['gender'] ?? 'Not specified';
  $skills = isset($_POST['skills']) ? implode(", ", $_POST['skills']) : "None";
  $city   = $_POST['city'];

  echo "Name: $name<br>";
  echo "Email: $email<br>";
  echo "Gender: $gender<br>";
  echo "Skills: $skills<br>";
  echo "City: $city<br>";
}
?>

5. PHP Form Validation

Definition: Form validation is the process of checking that submitted form data is correct, complete, and safe before using it.

Why Validate?

• Prevent empty submissions.
• Ensure correct data format (e.g., valid email).
• Protect against malicious input (XSS attacks).

Common Validation Functions:

Complete Validation Example:

<?php
$nameErr = $emailErr = "";
$name = $email = "";

if ($_SERVER["REQUEST_METHOD"] == "POST") {
  if (empty($_POST["name"])) {
    $nameErr = "Name is required";
  } else {
    $name = htmlspecialchars(trim($_POST["name"]));
  }

  if (empty($_POST["email"])) {
    $emailErr = "Email is required";
  } elseif (!filter_var($_POST["email"], FILTER_VALIDATE_EMAIL)) {
    $emailErr = "Invalid email format";
  } else {
    $email = htmlspecialchars(trim($_POST["email"]));
  }
}
?>

6. The $_REQUEST Superglobal

$_REQUEST is a superglobal that contains the combined contents of $_GET, $_POST, and $_COOKIE. It is flexible but less secure than using specific method arrays.

// Works for BOTH GET and POST requests
$name = $_REQUEST['fname'];

When to use: Only when you genuinely need to handle both GET and POST. For most forms, use the specific $_POST or $_GET.