# PHP Forms Reference This reference consolidates key educational content from W3Schools covering PHP form handling, validation, required fields, URL/email validation, and a complete working example. --- ## PHP Form Handling > **Source:** ### How PHP Forms Work The PHP superglobals `$_GET` and `$_POST` are used to collect form data. When a user fills out a form and clicks submit, the form data is sent to a PHP file specified in the `action` attribute of the `
` tag. ### A Simple HTML Form ```html Name:
E-mail:
``` When the user fills out the form and clicks submit, the form data is sent via HTTP POST to `welcome.php`. The processing file can then access the data: ```php Welcome
Your email address is: ``` ### Using the GET Method ```html
Name:
E-mail:
``` ```php Welcome
Your email address is: ``` ### GET vs. POST | Feature | GET | POST | |---------|-----|------| | Visibility | Data is visible in the URL (as query string parameters) | Data is NOT displayed in the URL | | Bookmarking | Pages can be bookmarked with query string values | Pages cannot be bookmarked with submitted data | | Data length | Limited (max URL length is approximately 2048 characters) | No limitations on data size | | Security | Should NEVER be used for sending sensitive data (passwords, etc.) | More secure than GET for sensitive data | | Caching | Requests can be cached | Requests are not cached | | Browser history | Parameters remain in browser history | Parameters are not saved in browser history | | Use case | Non-sensitive data, search queries, filter parameters | Sensitive data, form submissions that change data | **Important:** Both `$_GET` and `$_POST` are superglobal arrays. They are always accessible regardless of scope, and you can access them from any function, class, or file without having to do anything special. --- ## PHP Form Validation > **Source:** ### Think Security When Processing PHP Forms These pages show how to process PHP forms with security in mind. Proper validation of form data is important to protect your form from hackers and spammers. ### The HTML Form The form used throughout this tutorial: - **Fields:** Name, E-mail, Website, Comment, Gender - **Validation rules:** | Field | Validation Rules | |---------|-----------------| | Name | Required. Must only contain letters and whitespace | | E-mail | Required. Must contain a valid email address (with `@` and `.`) | | Website | Optional. If present, must contain a valid URL | | Comment | Optional. Multi-line input field (textarea) | | Gender | Required. Must select one | ### The Form Element ```html
"> ``` The `$_SERVER["PHP_SELF"]` variable returns the filename of the currently executing script. So the form data is sent to the page itself instead of a different page. ### What is `$_SERVER["PHP_SELF"]`? `$_SERVER["PHP_SELF"]` is a superglobal variable that returns the filename of the currently executing script relative to the document root. ### Big Note on PHP Form Security The `$_SERVER["PHP_SELF"]` variable can be exploited by hackers via **Cross-Site Scripting (XSS)** attacks. **XSS** enables attackers to inject client-side script into web pages viewed by other users. For example, if the form is on a page called `test_form.php`, a user could enter the following URL: ``` http://www.example.com/test_form.php/%22%3E%3Cscript%3Ealert('hacked')%3C/script%3E ``` This translates to: ```html ``` The `