Form Handling

## Learning Objectives - Understand form submission methods - Work with GET and POST - Process form data safely - Validate form input ## HTML Forms ### Basic Form Structure ```html

Name: Email: Password: Submit

``` ### Form Attributes - `action`: URL to send data to - `method`: HTTP method (GET or POST) - `enctype`: Encoding type for file uploads ## GET vs POST ### GET Method ```php ``` Characteristics: - Data visible in URL - Can be bookmarked - Cached by browsers - Limited data size (~2000 chars) - Should not be used for sensitive data ### POST Method ```php ``` Characteristics: - Data not visible in URL - Cannot be bookmarked - Not cached - No size limit - Used for sensitive data and file uploads ## Processing Form Data ### Basic Processing Script ```php ``` ### Form with Multiple Inputs ```php trim($_POST['username'] ?? ''), 'email' => trim($_POST['email'] ?? ''), 'password' => $_POST['password'] ?? '', 'confirm' => $_POST['confirm'] ?? '', 'agree' => isset($_POST['agree']) ]; // Validate if ($data['password'] !== $data['confirm']) { echo "Passwords do not match."; } if (!$data['agree']) { echo "You must agree to terms."; } } ?> ``` ## Superglobal Variables ### $_GET ```php ``` ### $_POST ```php ``` ### $_REQUEST ```php ``` ### $_SERVER ```php ``` ## Input Filtering ### htmlspecialchars ```php alert("XSS")'; $safe = htmlspecialchars($input, ENT_QUOTES, 'UTF-8'); // <script>alert("XSS")</script> echo $safe; // Safe to display ?> ``` ### ENT_QUOTES Options ```php ``` ### strip_tags ```php Hello World!

'; strip_tags($input); //

Hello World!

strip_tags($input, ''); //

Hello World!

(allows ) // Better: htmlspecialchars for output, strip_tags for input ?> ``` ### trim() ```php ``` ## Validation Functions ### Empty Check ```php ``` ### String Validation ```php ``` ### Sanitization ```php alert('xss')"; filter_var($str, FILTER_SANITIZE_STRING); // Removes tags // Integer sanitization $int = "42abc"; filter_var($int, FILTER_SANITIZE_NUMBER_INT); // "42" // Float sanitization $float = "3.14abc"; filter_var($float, FILTER_SANITIZE_NUMBER_FLOAT); // "3.14" ?> ``` ### Regular Expression Validation ```php ``` ## Form Validation Example ### Complete Validation Script ```php ``` ### Displaying Errors ```php $errors[email]" : '' ?> ``` ## File Uploads ### HTML Form for Files ```html

Upload

``` ### Processing Upload ```php 5 * 1024 * 1024) { echo "File too large"; } // Check type $allowed = ['application/pdf', 'application/msword']; if (!in_array($file['type'], $allowed)) { echo "Invalid file type"; } // Move uploaded file $destination = __DIR__ . '/uploads/' . basename($file['name']); if (move_uploaded_file($file['tmp_name'], $destination)) { echo "File uploaded successfully"; } } } ?> ``` ## Cross-Site Request Forgery (CSRF) ### CSRF Token ```php ``` ```html

``` ### Validate CSRF Token ```php ``` ## Summary - Forms use `GET` (URL params) or `POST` (request body) - `$_GET`, `$_POST`, `$_REQUEST` access form data - Always validate and sanitize user input - `htmlspecialchars()` prevents XSS attacks - `trim()` removes whitespace - `empty()` and `isset()` for checking values - `filter_var()` for validation and sanitization - Use CSRF tokens to prevent cross-site request forgery - File uploads require `enctype="multipart/form-data"`