PHP Form Handling

PHP Form Handling: Processing GET and POST Requests Safely

PHP form handling connects an HTML <form> in the browser to backend PHP scripts via $_GET or $_POST. Choosing the right HTTP method and escaping output keeps your forms secure and prevents duplicate submissions.

GET vs POST for HTML Forms

Pick the HTTP method based on whether the form reads data or changes server state.

• Use method="GET" for search bars, filters, and pagination. Form values appear in the URL query string so users can bookmark or share results.
• Use method="POST" for logins, registrations, contact forms, and payments. Values travel inside the HTTP request body instead of browser history.

<?php
declare(strict_types=1);

$submittedName = '';
$submittedEmail = '';

if (($_SERVER['REQUEST_METHOD'] ?? 'GET') === 'POST') {
    $submittedName = trim((string) ($_POST['full_name'] ?? ''));
    $submittedEmail = trim((string) ($_POST['email'] ?? ''));
}
?>
<form method="POST" action="">
    <label for="full_name">Full Name</label>
    <input id="full_name" name="full_name" type="text" value="<?= htmlspecialchars($submittedName, ENT_QUOTES, 'UTF-8') ?>" required>

    <label for="email">Email</label>
    <input id="email" name="email" type="email" value="<?= htmlspecialchars($submittedEmail, ENT_QUOTES, 'UTF-8') ?>" required>

    <button type="submit">Send Message</button>
</form>

Preventing Duplicate Form Submissions (PRG Pattern)

After saving a successful POST form, respond with header('Location: /thank-you.php'); exit; instead of rendering HTML directly. This Post/Redirect/Get (PRG) pattern prevents accidental double charges or duplicate records if the user clicks refresh.

Common Mistakes to Avoid

• Using $_SERVER['PHP_SELF'] unescaped in action: Unescaped PHP_SELF allows reflected XSS attacks via crafted URLs. Leave action="" or escape it with htmlspecialchars().
• Skipping server-side checks because HTML has required: Users can bypass browser attributes in seconds. Always validate again in PHP.
• Forgetting exit after header('Location: ...'): PHP keeps running the rest of the script unless you call exit; right after sending a redirect header.

Frequently Asked Questions

What happens if an HTML input has no name attribute?

Browsers ignore inputs without a name attribute when submitting a form, so that field will never appear inside $_POST or $_GET.

Why are checkboxes missing from $_POST when unchecked?

Browsers only send checked checkboxes in form submissions. Check isset($_POST['agree_terms']) in PHP instead of assuming the key exists.

How do I protect PHP forms against Cross-Site Request Forgery (CSRF)?

Generate a random token via bin2hex(random_bytes(32)), store it in $_SESSION, put it in a hidden input, and verify it with hash_equals() on POST.