PHP Forms & User Inputs

PHP Form Processing

The PHP superglobals $_GET and $_POST are used to collect form-data from HTML forms. These arrays are populated automatically by the PHP runtime when a request is parsed.

Security & Sanitization

Always sanitize user inputs to prevent vulnerabilities like Cross-Site Scripting (XSS) and SQL Injection. Use functions like htmlspecialchars() or filter arrays.

The main difference between the two methods is visibility: $_GET appends variables to the URL, making them visible in browser history, whereas $_POST sends data in the HTTP request body, which is suitable for passwords.

For secure applications, form tokens must be implemented to prevent Cross-Site Request Forgery (CSRF), verifying that form submissions originate from authenticated site users.

GET Queries Parameters

The $_GET superglobal gathers key-value parameters from the URL query string, typically used for non-destructive operations like search filters.

php

<?php
$_GET["search"] = "php variables";
if (isset($_GET["search"])) {
    echo "Searching for: " . htmlspecialchars($_GET["search"]) . "\n";
}
?>

Run this Code

php

<?php
// Mock processing request parameters
$_POST["username"] = "dev_user";

if (isset($_POST["username"])) {
    $user = htmlspecialchars($_POST["username"]);
    echo "Form submitted! Hello, " . $user . "\n";
}
?>

Run this Code