PHP Forms – GET and POST Handling
In this lesson: Handle HTML forms in PHP with $_GET and $_POST, validate input and prevent XSS — full working code in Hindi & English.
How forms work
A form is how users send data to your website — a login, a contact message, a search. The browser collects what the user typed and sends it to a PHP page, which reads the data from $_POST or $_GET and acts on it. Handling forms safely is one of the most common PHP tasks.
method (GET or POST) decides which array PHP reads the data from.The HTML form
<form method="post" action="handle.php">
<input type="text" name="username">
<input type="email" name="email">
<button type="submit">Send</button>
</form>Each field's name is the key PHP will use. The action is the PHP page that receives the data, and method="post" means it arrives in $_POST.
Reading data in PHP
<?php
if ($_SERVER["REQUEST_METHOD"] === "POST") {
$username = $_POST["username"] ?? "";
$email = $_POST["email"] ?? "";
echo "Hi $username, email: $email";
}
?>The check for "POST" makes sure this only runs when the form is submitted. ?? "" gives an empty default if a field is missing, avoiding warnings.
GET vs POST
| Point | GET | POST |
|---|---|---|
| Data goes in | The URL | The request body |
| Visible in URL? | Yes | No |
| Best for | Search, filters | Login, sign-up |
| Bookmarkable? | Yes | No |
Use GET for things you want shareable in the URL (like a search), and POST for anything private or that changes data.
Sanitize the input
Clean the input before using or displaying it.
<?php
$username = trim($_POST["username"] ?? "");
$safe = htmlspecialchars($username);
echo "Welcome, $safe";
?>trim removes stray spaces; htmlspecialchars makes the value safe to show on the page, blocking XSS. Do this for every value you print.
Common mistakes
- Missing
nameattribute. Without it, the field never reaches$_POST. - Reading input without
?? "". A missing key gives an "undefined index" warning. - Not checking the request method. Handling code runs on the first load too, causing errors.
- Printing input without
htmlspecialchars. This opens an XSS hole.
Summary
- Forms send user data to a PHP page via GET or POST.
- Read POST data from
$_POST, GET data from$_GET, using the field name. - Use POST for private data, GET for shareable data like searches.
- Check
REQUEST_METHODbefore handling, and use?? ""for safety. - Always
trimandhtmlspecialcharsuser input.
Next, validate the data with form validation, or store it using a MySQL connection.
Frequently Asked Questions
What is the difference between GET and POST in a form?
How do I read form data in PHP?
$_POST array for POST forms and $_GET for GET forms, with the field's name attribute as the key — for example $_POST["email"]. Always use ?? "" to avoid warnings if the key is missing.Why must I sanitize form input?
htmlspecialchars() when displaying input keeps your site safe from XSS and keeps stored data clean. Never trust raw input.What does the name attribute do in a form field?
name attribute is the key PHP uses to read that field. <input name="email"> becomes $_POST["email"]. Without a name, the field is not sent to PHP.How do I check that a form was actually submitted?
if ($_SERVER["REQUEST_METHOD"] === "POST"). This runs your handling code only when the form is posted, not on the first page load.