Forms Handling
Learn how to build an HTML form and process its submitted data on the server using PHP.
Introduction
Forms are how most websites collect information from visitors — logging in, signing up, leaving a comment, checking out. In the last lesson you met the superglobals that hold this incoming data. Now it is time to actually build a form and process what gets submitted.
This lesson walks through creating a basic HTML form, sending it to a PHP script, and reading the submitted values with $_POST. By the end, you will have a complete, working form-processing example.
- How to build a basic HTML form that submits to a PHP script.
- How to read submitted form data using the $_POST superglobal.
- How to check $_SERVER["REQUEST_METHOD"] to detect a form submission.
- How to put it all together in a complete, working example.
Building a Basic HTML Form
An HTML form needs a method (usually GET or POST), an action (the page that will process the submission), and named input fields. The name attribute on each input is the key you will use to read its value in PHP.
<form method="POST" action="process.php">
<label for="name">Name:</label>
<input type="text" id="name" name="name">
<label for="email">Email:</label>
<input type="email" id="email" name="email">
<button type="submit">Submit</button>
</form>When the visitor clicks Submit, the browser sends a POST request to process.php, carrying the values typed into the name and email fields.
Processing Submitted Data
On the receiving end, process.php reads the submitted values out of the $_POST superglobal, using the same names given to the name attributes in the form.
<?php
$name = $_POST["name"];
$email = $_POST["email"];
echo "Thanks, $name! We will contact you at $email.\n";
?>Thanks, Alice! We will contact you at alice@example.com.Detecting the Request Method
It is common to put the form and its processing logic in the same file. To do that safely, you first check whether the page was requested with POST — meaning the form was actually submitted — before trying to read any $_POST values.
<?php
if ($_SERVER["REQUEST_METHOD"] === "POST") {
echo "The form was submitted.\n";
} else {
echo "Just viewing the page, no form submitted yet.\n";
}
?>Just viewing the page, no form submitted yet.Without this check, PHP will try to read $_POST["name"] on the very first page load — before any form has been submitted — and generate an "undefined array key" warning because the value simply does not exist yet.
Full Worked Example
Combining the form and the processing logic into a single self-submitting file is a common pattern. The page checks the request method, processes the data if it was submitted, and always re-displays the form.
<?php
$name = "";
$email = "";
$submitted = false;
if ($_SERVER["REQUEST_METHOD"] === "POST") {
$name = $_POST["name"];
$email = $_POST["email"];
$submitted = true;
}
?>
<!DOCTYPE html>
<html>
<body>
<h1>Sign Up</h1>
<?php if ($submitted): ?>
<p>Thanks for signing up, <?php echo $name; ?>!</p>
<p>We will email confirmation to <?php echo $email; ?>.</p>
<?php endif; ?>
<form method="POST" action="signup.php">
<label for="name">Name:</label>
<input type="text" id="name" name="name">
<label for="email">Email:</label>
<input type="email" id="email" name="email">
<button type="submit">Sign Up</button>
</form>
</body>
</html>Sign Up
Thanks for signing up, Bob!
We will email confirmation to bob@example.com.
[Form fields shown again below]This pattern — one file that both displays the form and handles its submission — keeps related logic together and is extremely common in real PHP applications.
Why Raw Input Still Needs Validation
The signup.php example above works, but it has an important gap: it trusts $_POST["name"] and $_POST["email"] completely. Nothing stops a visitor from submitting an empty name, an email address with no @ symbol, or text containing HTML tags.
Raw form input is just whatever the visitor typed (or whatever an attacker's script sent) — it is never automatically clean, complete, or safe. The next lesson covers form validation: checking that required fields are filled in, that formats like email addresses are correct, and that anything echoed back to the page is safely escaped.
Common Mistakes
- Reading $_POST values without first checking that the request method is actually POST.
- Forgetting the name attribute on an HTML input, so PHP has no key to read the value with.
- Mismatching the name attribute in the form with the array key used in $_POST.
- Trusting submitted data as complete and correctly formatted without any validation.
Best Practices
- Always guard $_POST access behind a check on $_SERVER["REQUEST_METHOD"].
- Give form inputs clear, matching name attributes that map directly to the keys you read in PHP.
- Keep the form-display and form-processing logic in the same file when the workflow is simple, for easier maintenance.
- Treat every submitted value as unverified until it has been validated (covered in the next lesson).
Frequently Asked Questions
Should I use GET or POST for a form?
Use POST for anything that changes data or includes sensitive information, since POST data is not shown in the URL. GET is fine for things like search forms, which the next lesson covers in more depth.
What happens if a form input has no name attribute?
PHP has no way to read its value, because $_POST and $_GET are keyed by the name attribute, not the id attribute.
Can one PHP file both display and process a form?
Yes, this is a very common pattern: the file checks the request method, processes $_POST if present, and always renders the form below.
Is it safe to echo $_POST values directly like in the examples above?
Not for production code. These examples keep things simple to focus on the mechanics of handling forms; the next lesson covers validating and safely escaping this data.
Do file uploads work the same way through $_POST?
No, uploaded files arrive through the separate $_FILES superglobal, even though the file input lives inside the same form.
Key Takeaways
- An HTML form needs a method, an action, and named inputs to send data to a PHP script.
- Submitted form values are read from the $_POST (or $_GET) superglobal using each input's name attribute.
- Checking $_SERVER["REQUEST_METHOD"] lets you detect whether a form was actually submitted.
- A single PHP file can both display a form and process its submission.
- Raw submitted data is not automatically valid or safe — it must still be validated before it is trusted.
Summary
Handling forms is one of the most fundamental jobs of server-side PHP: display a form, receive its data through a superglobal, and respond based on what was submitted. You built a full working example that does exactly that.
In this lesson, you built an HTML form, processed its data with $_POST, and learned to detect a submission with $_SERVER["REQUEST_METHOD"]. Next, you will learn how to properly validate that submitted data before trusting it.
- You can build a basic HTML form that submits to a PHP script.
- You can read submitted values using the $_POST superglobal.
- You can detect a form submission by checking the request method.
- You are ready to learn how to validate submitted data.