Web Forms, Requests, and Validation

What you will learn

Explain GET and POST at a practical beginner level.
Read request data defensively with $_GET and $_POST.
Validate meaning separately from escaping output.
Build a small form-processing workflow with clear success and error states.

The code from this chapter

Type these programs yourself. The predictions below are the exercises; the explanations are in the book.

10.1 PHP in a Web Request

Type this into a file, predict the output, then run it.

PHP

<?php

declare(strict_types=1);

echo "<h1>Hello from the server</h1>";
echo "This page was built by PHP for a " . $_SERVER["REQUEST_METHOD"] . " request.";

10.2 Reading Request Data Defensively

Type this into a file, predict the output, then run it.

PHP

<?php

declare(strict_types=1);

$name = trim($_POST["name"] ?? "");
$page = $_GET["page"] ?? "1";

echo "Name length: " . strlen($name) . "";
echo "Page: " . htmlspecialchars($page, ENT_QUOTES, "UTF-8") . "";

10.3 Validation and Safe HTML Output

Type this into a file, predict the output, then run it.

PHP

<?php

declare(strict_types=1);

var_dump(filter_var("maya@example.com", FILTER_VALIDATE_EMAIL));
var_dump(filter_var("not-an-email", FILTER_VALIDATE_EMAIL));
var_dump(filter_var("0", FILTER_VALIDATE_INT));

10.4 One Page, Two Jobs

Type this into a file, predict the output, then run it.

PHP

<?php

declare(strict_types=1);

function h(string $value): string
{
    return htmlspecialchars($value, ENT_QUOTES, "UTF-8");
}

$name = "";
$errors = [];
$success = false;

if ($_SERVER["REQUEST_METHOD"] === "POST") {
    $name = trim($_POST["name"] ?? "");

    if ($name === "") {
        $errors[] = "Name is required.";
    }

    if ($errors === []) {
        $success = true;
    }
}
?>
<!doctype html>
<html lang="en">
<head>
  <meta charset="utf-8">
  <title>Contact</title>
</head>
<body>
<?php if ($success): ?>
  Thank you, <?= h($name) ?>.
<?php else: ?>
  <?php foreach ($errors as $error): ?>
    <p class="error"><?= h($error) ?>
  <?php endforeach; ?>
  <form method="post" action="contact.php">
    <label for="name">Name</label>
    <input id="name" name="name" type="text" value="<?= h($name) ?>">
    <button type="submit">Send</button>
  </form>
<?php endif; ?>
</body>
</html>

TPRM Lab 10.1: Handle a POSTed Name

Type this into a file, predict the output, then run it.

PHP

<?php

declare(strict_types=1);

function h(string $value): string
{
    return htmlspecialchars($value, ENT_QUOTES, "UTF-8");
}

$name = trim($_POST["name"] ?? "");
$error = "";

if ($name === "") {
    $error = "Name is required.";
}

if ($error !== "") {
    echo "" . h($error) . "";
} else {
    echo "Hello, " . h($name) . "!";
}
?>
<form method="post">
  <label for="name">Name</label>
  <input id="name" name="name" type="text">
  <button type="submit">Send</button>
</form>

TPRM Lab 10.2: Validate an Email

Type this into a file, predict the output, then run it.

PHP

<?php

declare(strict_types=1);

$email = trim($_POST["email"] ?? "");

if ($email === "") {
    echo "Email is required.";
} elseif (filter_var($email, FILTER_VALIDATE_EMAIL) === false) {
    echo "Email is not valid.";
} else {
    echo "Email accepted.";
}
?>
<form method="post">
  <label for="email">Email</label>
  <input id="email" name="email" type="text">
  <button type="submit">Check</button>
</form>