PHP Form Handling POST

PHP Form Handling POST Method

By Tim-Bo Tolbert, posted on Feb 17, 2023

Two common ways for collecting submitted data from a client is by using the GET and/or POST methods. A PHP web page can use one or the other, or both methods at the same time. This document discusses how to use the POST method.

Unlike the GET method, which encodes the URL string with visible key/pair values, the POST method passes values back to the server in an invisible manner that is not tied to the URL.

PHP uses the $_POST superglobal variable to collect the clients form data from an encoded URL. The $_POST superglobal variable is an array of the key/value pairs that are passed to the script via the forms POST method (example: array(key1=>value1, key2=>value2, key3=>value3, ...)).

The web form which submits and transmits the clients data values can send the posted values to itself or to another web page.

Unlike the GET method, the URL of a post is not encoded with any key/value pair values, therefore it does very little to bookmark the URL, since the posted values are not retained in the URL data.

When to use POST?

The POST method may be used for sending non-sensitive and sensitive data from the client to the server.

The information sent from a clients form with the POST method is invisible to everyone except the target web page that the clients form is posting to. This helps to keep sensitive values a little more secure.

Unlike the GET method which is limited to a certain number of characters, the POST method is unlimited, meaning that the client form can POST a very large amount of form data to the server, including Images, Audio, and even Video files.

The POST method supports advanced functionality as well, such as support for multi-part binary input (i.e. often used for when uploading multiple files at once). This is accomplished simply by specifying the enctype within the forms attributes (as is shown in the Login.php example code below).

Most web developers prefer using the POST method instead of the GET method, mainly because of the above mentioned reasons.

Example:

The following example shows a simple 'Login' HTML form which contains two input fields and a submit button. The form uses the POST method to send the form values to an Account.php web page:

PHP : Login.php

<!DOCTYPE html>
<html>
<body>
    <h1>Login:</h1>
    <form action="Account.php" method="post" enctype="multipart/form-data">
        UserName: <input type="text" name="UserName"> <br>
        Password: <input type="password" name="UserPassword"> <br>
        <input type="submit">
    </form>
</body>
</html>

The <input type="password"> defines a password field which masks the characters. This means that the password type input box will hide the displayed values by displaying asterisk symbols instead of the actual characters values (****).

In the example above, when the user clicks on the Submit button the form calls a different web page (Account.php) and passes to it the forms values using the POST method. The following demonstrates how a PHP web page can acquire and use the values passed to it:

PHP : Account.php

<!DOCTYPE html>
<?php

// set default values
$uName = "";
$uPassword = "";
$lastDate = "";
$feedbackMessage = "";

// retrieve posted values
if($_SERVER["REQUEST_METHOD"] == "POST")
{
    $uName = $_POST["UserName"];
    $uPassword = $_POST["UserPassword"];

    // TODO : code function to clean and validate values 

    // TODO : code function to authenticate and log the client in
    $_SESSION["UserName"] = $uName;
	
    // TODO : code function to retrieve last logged in date, and then update that value with todays date
    $lastDate = date("l M d, Y");
	
    // Generate Feedback Message
    $feedbackMessage = "Welcome " . $uName . ", you last logged in on " . $lastDate . "!";
}

// check if user is logged in or not
if(!isset($_SESSION["UserName"]) || empty($_SESSION["UserName"]))
{
    // no user is logged in, so navigate to the login page
    header("Location: Login.php");
    die();
}
else
{
    // TODO : build page elements that are unique for this logged in user 
}

?>
<html>
<body>
    <h1>Member Account</h1>
    <p><?php echo($feedbackMessage); ?></p>
</body>
</html>

The above examples are only meant to expose you to the very basics, and demonstrate how to use the POST method for sending client form data from one page to another, and how to use the $_POST superglobal for retrieving and using the data values that were passed.

Final Thoughts

Thank you for reading, I hope you found this blog post (tutorial) educational and helpful.

	(0)
	(0)