Form ProcessingForm processing is a fundamental aspect of web development, enabling user interaction by collecting data through HTML forms and handling it on the server-side. In the context of PHP, this typically involves receiving form submissions, validating the data, sanitizing it for security, and then performing an action such as saving to a database, sending an email, or displaying results.
1. HTML Form Basics:
A web form is defined using the `<form>` HTML tag. Key attributes for form processing are:
* `action`: Specifies the URL where the form data will be sent for processing. If omitted, the data is sent to the current page.
* `method`: Defines the HTTP method used to send the data. The two most common methods are `GET` and `POST`.
* `GET`: Appends form data to the URL as name/value pairs (e.g., `page.php?name=John&email=john@example.com`). Data is visible in the URL, has size limitations, and is suitable for non-sensitive data or search queries (idempotent operations).
* `POST`: Sends form data in the body of the HTTP request. Data is not visible in the URL, has no practical size limitations, and is preferred for sensitive data (passwords, personal info) or when data modifies the server state (creating, updating).
Input elements (`<input>`, `<textarea>`, `<select>`) must have a `name` attribute. This `name` attribute is crucial because it serves as the key to access the submitted data on the server.
2. PHP Superglobals for Form Data:
PHP provides superglobal arrays to access form data:
* `$_GET`: An associative array containing data sent via the GET method.
* `$_POST`: An associative array containing data sent via the POST method.
* `$_REQUEST`: An associative array containing data from `$_GET`, `$_POST`, and `$_COOKIE`. While convenient, it's generally better practice to use `$_GET` or `$_POST` explicitly for clarity and to avoid potential conflicts.
3. Checking for Form Submission:
Before attempting to process form data, it's essential to check if the form has actually been submitted. This is commonly done by checking the `$_SERVER["REQUEST_METHOD"]` variable or by checking if a specific submit button's name is set in `$_POST`.
4. Data Validation:
Validation ensures that the submitted data conforms to expected formats and rules. This is critical for data integrity and application logic. Common validation checks include:
* Checking if required fields are empty.
* Validating email addresses using `filter_var()`.
* Ensuring numerical inputs are indeed numbers.
* Checking string length, specific patterns (e.g., using `preg_match()`), or allowed values.
5. Data Sanitization:
Sanitization involves cleaning up user input to remove or neutralize potentially harmful characters or scripts. This is vital for security, primarily to prevent Cross-Site Scripting (XSS) attacks. Common PHP functions for sanitization:
* `trim()`: Removes whitespace from the beginning and end of a string.
* `stripslashes()`: Removes backslashes added by PHP's `magic_quotes_gpc` (which is deprecated and usually off, but good practice for ensuring clean data).
* `htmlspecialchars()`: Converts special characters (&, ", ', <, >) to HTML entities, preventing them from being interpreted as HTML or JavaScript.
6. Error Handling and Feedback:
When validation fails, it's important to provide clear and user-friendly error messages to the user, guiding them to correct their input. Often, the form fields are re-populated with the user's previous valid input to improve user experience.
7. Success Handling:
After successful validation and processing, the user should receive appropriate feedback, such as a success message, or be redirected to another page (e.g., a 'thank you' page).
Example Code
```php
<?php
// Initialize variables to store form data and error messages
$name = $email = $message = "";
$nameErr = $emailErr = $messageErr = "";
$successMessage = "";
// Function to sanitize and validate input data
function test_input($data) {
$data = trim($data); // Remove whitespace from the beginning and end of string
$data = stripslashes($data); // Remove backslashes
$data = htmlspecialchars($data); // Convert special characters to HTML entities
return $data;
}
// Check if the form has been submitted using POST method
if ($_SERVER["REQUEST_METHOD"] == "POST") {
// 1. Validate Name
if (empty($_POST["name"])) {
$nameErr = "Name is required";
} else {
$name = test_input($_POST["name"]);
// Check if name contains only letters and whitespace
if (!preg_match("/^[a-zA-Z-' ]*$/", $name)) {
$nameErr = "Only letters and white space allowed";
}
}
// 2. Validate Email
if (empty($_POST["email"])) {
$emailErr = "Email is required";
} else {
$email = test_input($_POST["email"]);
// Check if e-mail address is well-formed
if (!filter_var($email, FILTER_VALIDATE_EMAIL)) {
$emailErr = "Invalid email format";
}
}
// 3. Validate Message
if (empty($_POST["message"])) {
$messageErr = "Message cannot be empty";
} else {
$message = test_input($_POST["message"]);
}
// If no errors, process the data
if (empty($nameErr) && empty($emailErr) && empty($messageErr)) {
// Here you would typically save the data to a database, send an email, etc.
// For this example, we'll just display a success message.
$successMessage = "Thank you, " . htmlspecialchars($name) . "! Your message has been received.";
// Clear the form fields after successful submission (optional, but good UX)
$name = $email = $message = "";
}
}
?>
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="UTF-8">
<meta name="viewport" content="width=device-width, initial-scale=1.0">
<title>PHP Form Processing Example</title>
<style>
.error { color: red; }
.success { color: green; font-weight: bold; }
form { margin-top: 20px; padding: 20px; border: 1px solid #ccc; border-radius: 5px; width: 300px; }
label { display: block; margin-bottom: 5px; }
input[type=\"text\"], input[type=\"email\"], textarea {
width: 100%;
padding: 8px;
margin-bottom: 10px;
border: 1px solid #ddd;
border-radius: 4px;
box-sizing: border-box; /* Include padding and border in the element's total width and height */
}
input[type=\"submit\"] {
background-color: #4CAF50;
color: white;
padding: 10px 15px;
border: none;
border-radius: 4px;
cursor: pointer;
font-size: 16px;
}
input[type=\"submit\"]:hover {
background-color: #45a049;
}
</style>
</head>
<body>
<h1>Contact Us</h1>
<?php if (!empty($successMessage)): ?>
<p class="success"><?php echo $successMessage; ?></p>
<?php endif; ?>
<form method="post" action="<?php echo htmlspecialchars($_SERVER[\"PHP_SELF\"]); ?>">
<label for="name">Name:</label>
<input type="text" id="name" name="name" value="<?php echo htmlspecialchars($name); ?>">
<span class="error"><?php echo $nameErr; ?></span>
<br><br>
<label for="email">E-mail:</label>
<input type="email" id="email" name="email" value="<?php echo htmlspecialchars($email); ?>">
<span class="error"><?php echo $emailErr; ?></span>
<br><br>
<label for="message">Message:</label>
<textarea id="message" name="message" rows="5"><?php echo htmlspecialchars($message); ?></textarea>
<span class="error"><?php echo $messageErr; ?></span>
<br><br>
<input type="submit" name="submit" value="Submit">
</form>
</body>
</html>
```