# PHP Form Handling

The PHP superglobals `$_GET` and `$_POST` are used to collect form-data.

---

## 1. Simple HTML Form
Here is an example of a simple HTML form with two input fields and a submit button:

```html
<form action="welcome.php" method="post">
Name: <input type="text" name="name"><br>
E-mail: <input type="text" name="email"><br>
<input type="submit">
</form>
```

## 2. Handling the Data (POST)
When the user fills out the form above and clicks the submit button, the form data is sent for processing to a PHP file named "welcome.php". The form data is sent with the HTTP POST method.

To display the submitted data you could simply echo all the variables.

```php
Welcome <?php echo $_POST["name"]; ?><br>
Your email address is: <?php echo $_POST["email"]; ?>
```

## 3. GET vs. POST

*   **GET:**
    *   Parameters remain in browser history because they are part of the URL.
    *   Can be bookmarked.
    *   **NEVER** use GET for sensitive data (passwords).
    *   Note: `$_GET` is an array of variables passed to the current script via the URL parameters.

*   **POST:**
    *   Parameters are not saved in browser history.
    *   Cannot be bookmarked.
    *   Used for sending sensitive data.
    *   Note: `$_POST` is an array of variables passed to the current script via the HTTP POST method.

## 4. Basic Security
When processing form data, it is crucial to validate and sanitize the input to prevent security vulnerabilities like Cross-Site Scripting (XSS).

Use `htmlspecialchars()` to convert special characters to HTML entities.

```php
$name = htmlspecialchars($_POST['name']);
$email = htmlspecialchars($_POST['email']);
```

[[programming/php/php]]