User Input
Learn how PHP receives user input primarily through HTML forms, using $_GET and $_POST to read submitted data.
Introduction
If you have learned another programming language before, you might expect "user input" to mean something like a console prompt that pauses your program and waits for the user to type a value. PHP is different, because PHP was built for the web from day one — and on the web, users do not type into a terminal, they fill out HTML forms.
This lesson introduces how PHP receives data submitted by users through forms, using the $_GET and $_POST superglobal arrays. A full, dedicated lesson on superglobals is coming later in this course — for now, think of this as a practical first look at the two you will use constantly.
- Why PHP has no built-in equivalent to a console input() function.
- How HTML forms send data to a PHP script.
- How to read submitted form data using $_GET and $_POST.
- A complete, working form-and-processing example.
- Why raw user input should never be trusted directly.
PHP is Web-Oriented
Languages like Python or C++ often run as standalone programs in a terminal, where a function like input() can pause execution and wait for someone to type something. PHP scripts, by contrast, almost always run as part of handling a single web request: a browser asks for a page, the PHP script runs once, produces HTML, and then the script ends.
There is no "waiting for the user to type" moment inside a typical PHP script, because the user already submitted everything they are going to submit before the script even started running — usually by filling out and submitting an HTML form.
Instead of thinking "PHP pauses to ask the user a question," think "the user already answered by submitting a form, and PHP's job is to read what they sent."
Forms as PHP's "Input"
An HTML <form> element collects values from input fields and sends them to a target PHP script when submitted. Two attributes matter most: action (which script receives the data) and method (how the data is sent — usually GET or POST).
<form action="process.php" method="post">
<label for="name">Your Name:</label>
<input type="text" id="name" name="name">
<label for="email">Your Email:</label>
<input type="email" id="email" name="email">
<button type="submit">Submit</button>
</form>When this form is submitted, the browser sends the values typed into the "name" and "email" fields to process.php. Inside that script, PHP makes those values available in a superglobal array, keyed by each field's name attribute.
Reading Data with $_GET
When a form uses method="get" (or when data is appended directly to a URL as a query string, like page.php?id=5), PHP places that data into the $_GET superglobal array. GET data is visible in the URL, so it is best suited for non-sensitive things like search terms or page filters.
<?php
// Visiting greet.php?name=Amol would produce:
$name = $_GET['name'] ?? 'Guest';
echo "Hello, $name!";
?>Hello, Amol!Reading Data with $_POST
When a form uses method="post", the submitted data is placed into the $_POST superglobal array instead. POST data is not visible in the URL, making it the right choice for sensitive information like passwords, and for any data that changes something on the server.
<?php
$name = $_POST['name'] ?? '';
$email = $_POST['email'] ?? '';
echo "Name: $name\n";
echo "Email: $email\n";
?>Name: Amol
Email: amol@example.comThe null coalescing operator (??) returns a fallback value when the left side does not exist or is null. Using $_GET['name'] ?? 'Guest' avoids a warning if the "name" field was never submitted at all.
A Complete Form Example
Here is a minimal but complete pair of files: an HTML form, and the PHP script that processes what it submits.
<form action="handle-contact.php" method="post">
<input type="text" name="username" placeholder="Your name">
<textarea name="message" placeholder="Your message"></textarea>
<button type="submit">Send</button>
</form><?php
$username = $_POST['username'] ?? '';
$message = $_POST['message'] ?? '';
if ($username === '' || $message === '') {
echo "Please fill out both fields.";
} else {
echo "Thanks, $username! We received your message.";
}
?>Thanks, Priya! We received your message.Why You Should Never Trust Raw Input
Anything arriving through $_GET or $_POST comes directly from the visitor's browser — and a visitor can send absolutely anything, whether by typing unexpected characters into a form, editing the URL by hand, or bypassing your HTML entirely and sending a crafted request. PHP will not stop you from using that raw data as-is, which is exactly the problem.
Treat every value from $_GET and $_POST as untrusted until you have validated and sanitized it. This course has dedicated lessons coming up on Form Validation and Security that cover exactly how to do this safely — for now, just remember that raw input is never automatically safe to use, display, or store.
Common Mistakes
- Expecting a console-style input() function — PHP's "input" comes from forms, not a paused prompt.
- Accessing $_GET or $_POST keys directly without checking they exist, which triggers warnings if a field was never submitted.
- Using GET for sensitive data like passwords, since GET values are visible in the URL and browser history.
- Trusting form data as safe just because your own HTML form only offers "valid" choices — anyone can submit a request that skips your form entirely.
Best Practices
- Use $_POST for anything sensitive or that changes data on the server; use $_GET mainly for simple filters, searches, or pagination.
- Always provide a fallback with ?? when reading superglobal values.
- Match your form's method attribute to the superglobal you read from — a "post" form's data will not appear in $_GET.
- Remember that validation and sanitization are separate steps you will need to add before trusting or storing input.
Frequently Asked Questions
Does PHP have a function like Python's input()?
Not in a typical web context. PHP scripts running for a web request receive data all at once through superglobals like $_GET and $_POST rather than pausing to ask for input.
What is the difference between $_GET and $_POST?
$_GET reads data sent via the URL query string (visible and bookmarkable), while $_POST reads data sent in the body of the request (not visible in the URL), typically used for forms with method="post".
Can I read command-line input in PHP?
Yes, but only when running PHP from the command line interface (CLI) using functions like readline() or fgets(STDIN) — this is a separate use case from PHP's primary role handling web requests.
Is it safe to directly echo out $_POST data back to the page?
No. Doing so without sanitizing it first can expose your site to attacks like cross-site scripting (XSS). This is covered in detail in later Security and Validation lessons.
Key Takeaways
- PHP is fundamentally web-oriented, so "user input" usually means data submitted through HTML forms, not a console prompt.
- $_GET reads data sent via the URL query string or a form with method="get".
- $_POST reads data sent in the request body via a form with method="post".
- A form's "name" attributes become the keys used to access submitted values.
- Raw input from $_GET or $_POST should never be trusted directly — validation and sanitization come in later lessons.
Summary
Unlike languages built around a console, PHP receives user input primarily through HTML forms submitted over HTTP. The $_GET and $_POST superglobals are how you read that data inside your scripts — a full lesson on all of PHP's superglobals is still ahead, along with dedicated lessons on validating and securing whatever the user sends.
- You understand why PHP's "input" model differs from console-based languages.
- You can read submitted values using $_GET and $_POST.
- You built a complete form-and-processing example.
- You know why raw user input must never be trusted without validation.