Table of contents

Introduction

Text Fields

Radio Button

Form Element

Security issues

5.1.

How to avoid it?

PHP Get Form

PHP Post Form

Frequently Asked Questions

8.1.

What is $_POST PHP form?

8.2.

What is $_GET and $_POST in PHP?

8.3.

What is $_COOKIE in PHP?

Conclusion

Last Updated: Jan 15, 2025

Easy

PHP Form

Author Akash

Do you think IIT Guwahati certified course can help you in your career?

Yes

Introduction

Forms are used everywhere in development to store data in the backend. In PHP, form variables defined in the context are linked to the form elements, and a post-action is created to submit the form in the storage. We will first see some elements that use form validation and deal with the security issue.

Let us create a form with the below-mentioned fields

Name	Must contain only letter and whitespaces and is required
Email	Must be in email format and is required
Profile Link	Should be a link
Message	No rule
Slot	One must be selected

Text Fields

The below code illustrates name, email, profile link, message fields as text input. To take multiple text input lines, one can use textarea and specify the lines of rows and columns they need.

Name: <input type="text" name="name">
email : <input type="text" name="email">
profile link: <input type="text" name="website">
Message: <textarea name="message" rows="5" cols="10"></textarea>

Radio Button

Slot:

<input type="radio" name="slot" value="morning">Morning
<input type="radio" name="slot" value="afternoon">Afternoon
<input type="radio" name="slot" value="evening">Evening

Form Element

<form method="post" action="<?php echo htmlspecialchars($_SERVER[“PHP_SELF”]);>”>

Security issues

$_SERVER[“PHP_SELF”]) can be used to push malware codes by the hacker.

"http://www.test.com/form.php" is translated to <form method=”post” action=”form.php”>.

While a user can even do something like below

http://www.test.com/form.php/%22%3E%3Cscript%3Ealert('hacked')%3C/script%3E

<form method="post" action="test_form.php/"><script>alert('hacked')</script>

The hacker injected an unwanted script into the page. Now he can exploit information from the site. As he gains access, the javascript code injected is capable to scrap out critical information of the user like passwords, files and card information.

How to avoid it?

Using htmlspecialchars($_SERVER[“PHP_SELF]) can handle such attacks. It works by converting quotations,brackets to HTML entities like &quot , &gt, &lt. Now if the hacker tries to inject his script. The code will get converted to HTML.

For example:

<form method="post" action="form.php/"><script>alert('hacked')</script>">

pts into the user’s page to scrap out information or do anything with the inf

Form example:

<!DOCTYPE HTML> 
<html>
<head>
</head>
<body> 

<?php
// we define empty set of variables
$name = $email = $slot = $message = $website = "";

if ($_SERVER["REQUEST_METHOD"] == "POST") {
 $name = test_input_data($_POST["name"]);
 $email = test_input_data($_POST["email"]);
 $website = test_input_data($_POST["website"]);
 $message = test_input_data($_POST["message"]);
 $slot = test_input_data($_POST["slot"]);
}
// the below functions strips data from HTML //codespaces
function test_input_data($data) {
 $data = trim($data);
 $data = stripslashes($data);
 $data = htmlspecialchars($data);
 return $data;
}
?>

<form method="post" action="<?php echo htmlspecialchars($_SERVER[“PHP_SELF”]);>”>

 Name: <input type="text" name="name">
 E-mail: <input type="text" name="email">
 Profile <input type="text" name="website">
 Message: <textarea name="message" rows="5" cols="20"></textarea>
 <br>
 Slot:
 <input type="radio" name="slot" value="morning">Morning
 <input type="radio" name="slot" value="afternoon">Afternoon
 <hr/>
 <input type="submit" name="submit" value="Submit"> 
</form>
<?php
echo "<h2> Input:</h2>";
echo $name;
echo $email;
echo $Profile;
echo $message;
echo $slot;
?>
</body>
</html>

Must Read PHP Projects With Source Code

PHP Get Form

The GET method is used to send form data via the URL, making it visible in the browser’s address bar. It is generally used for retrieving data or when the form submission does not involve sensitive information. Parameters are appended to the URL in a query string.

Example:

<form method="get" action="process.php">
    <input type="text" name="username">
    <input type="submit" value="Submit">
</form>

In this example, the form data is sent via the URL, such as process.php?username=value.

PHP Post Form

The POST method is used to send form data to the server in the body of the HTTP request, making it invisible in the URL. It is more secure than GET and is typically used for submitting sensitive data such as passwords or large amounts of data.

Example:

<form method="post" action="process.php">
    <input type="text" name="username">
    <input type="submit" value="Submit">
</form>

In this example, the form data is sent to process.php but is not visible in the URL. The data can be accessed using $_POST in PHP.

Frequently Asked Questions

What is $_POST PHP form?

$_POST is a PHP superglobal array used to collect form data sent via the POST method. It allows secure data submission without displaying it in the URL.

What is $_GET and $_POST in PHP?

$_GET retrieves form data sent via the GET method (visible in the URL), while $_POST retrieves data sent via the POST method (hidden in the request body).

What is $_COOKIE in PHP?

$_COOKIE is a PHP superglobal array that stores data sent by the client’s browser via cookies. It allows data to persist between requests.

Conclusion

We went through setting up a form for validation and used htmlspecialchars to help eliminate exploits. In the next article, you will see how to create error messages, validations in email and much more.

You can take a look at our PHP archives section and see many more interesting topics related to it.

Live masterclass

Top GenAI Skills to crack 30 LPA+ roles at Amazon & Google

by Sumit Shukla

02 Feb, 2026

03:00 PM

34+ registered

Python + AI Skills to ace 30L+ CTC Data roles at Amazon

by Prerita Agarwal

01 Feb, 2026

06:30 AM

537+ registered

Top 5 GenAI Projects to Crack 25 LPA+ Roles in 2026

by Shantanu Shubham

01 Feb, 2026

08:30 AM

181+ registered

Zero to Data Analyst: Amazon Analyst Roadmap for 30L+ CTC

by Abhishek Soni

02 Feb, 2026

01:30 PM

345+ registered

Top GenAI Skills to crack 30 LPA+ roles at Amazon & Google

by Sumit Shukla

02 Feb, 2026

03:00 PM

34+ registered

Python + AI Skills to ace 30L+ CTC Data roles at Amazon

by Prerita Agarwal

01 Feb, 2026

06:30 AM

537+ registered

View more events