PHP Forms

PHP forms allow you to collect user input via HTML forms and process it server-side. Always validate and sanitize input to prevent security vulnerabilities.

HTML Form with GET and POST

The method attribute determines how data is sent. Use POST for sensitive data and GET for search/filter queries.

HTML Form

<!-- GET form — data appears in URL -->
<form action="search.php" method="GET">
    <input type="text" name="q" placeholder="Search...">
    <button type="submit">Search</button>
</form>

<!-- POST form — data in request body -->
<form action="register.php" method="POST">
    <input type="text"     name="username" required>
    <input type="email"    name="email"    required>
    <input type="password" name="password" required>
    <select name="role">
        <option value="user">User</option>
        <option value="admin">Admin</option>
    </select>
    <button type="submit">Register</button>
</form>

Form Validation & Sanitization

Always validate required fields and sanitize input with htmlspecialchars() to prevent XSS. Use filter_var() for type-specific validation.

Form Processing & Validation

<?php
$errors = [];
$name = $email = $age = "";

if ($_SERVER["REQUEST_METHOD"] === "POST") {

    // Required field check
    if (empty($_POST["name"])) {
        $errors[] = "Name is required.";
    } else {
        $name = htmlspecialchars(trim($_POST["name"]));
    }

    // Email validation
    if (empty($_POST["email"])) {
        $errors[] = "Email is required.";
    } elseif (!filter_var($_POST["email"], FILTER_VALIDATE_EMAIL)) {
        $errors[] = "Invalid email format.";
    } else {
        $email = filter_var($_POST["email"], FILTER_SANITIZE_EMAIL);
    }

    // Integer validation
    if (!filter_var($_POST["age"] ?? '', FILTER_VALIDATE_INT,
        ["options" => ["min_range" => 1, "max_range" => 120]])) {
        $errors[] = "Age must be between 1 and 120.";
    } else {
        $age = (int)$_POST["age"];
    }

    if (empty($errors)) {
        echo "Welcome, $name! Email: $email, Age: $age";
    }
}

// Display errors
foreach ($errors as $error) {
    echo "<p style='color:red'>$error</p>";
}
?>

filter_var() Validation Filters

filter_var() Examples

<?php
// Validate email
$email = "user@example.com";
if (filter_var($email, FILTER_VALIDATE_EMAIL)) {
    echo "Valid email";
}

// Validate URL
$url = "https://www.example.com";
if (filter_var($url, FILTER_VALIDATE_URL)) {
    echo "Valid URL";
}

// Validate integer
$num = "42";
if (filter_var($num, FILTER_VALIDATE_INT)) {
    echo "Valid integer";
}

// Validate IP address
$ip = "192.168.1.1";
if (filter_var($ip, FILTER_VALIDATE_IP)) {
    echo "Valid IP";
}

// Sanitize — remove dangerous characters
$dirty = "<script>alert('xss')</script>Hello";
$clean = htmlspecialchars($dirty, ENT_QUOTES, 'UTF-8');
echo $clean; // &lt;script&gt;alert('xss')&lt;/script&gt;Hello
?>

Previous Next

PHP Forms

HTML Form with GET and POST

Form Validation & Sanitization

filter_var() Validation Filters

Ready to Level Up Your Skills?