PHP Form Handling with GET, POST, and Validation

PHP form handling is one of the first real web development skills beginners should learn. A form lets a visitor send data to the server, and PHP decides what to do with that data: validate it, display an error, send an email, save a record, or return a success message.

This tutorial covers GET, POST, validation, and safe output. If you are still setting up your environment, start with How to Install PHP and How to Run Your First PHP Script Locally. The official PHP forms manual is also a useful reference.

PHP form handling: GET vs POST

GET sends form values in the URL query string. It is useful for search pages, filters, and links that should be shareable. POST sends form values in the request body. It is better for contact forms, login forms, account changes, and actions that should not expose data in the URL.

Do not treat POST as encryption. It hides values from the URL, but the request still needs HTTPS and server-side validation. The server must assume that every incoming value can be missing, malformed, or malicious.

A simple contact form

<form method="post" action="">
    <label>Name
        <input type="text" name="name">
    </label>
    <label>Email
        <input type="email" name="email">
    </label>
    <label>Message
        <textarea name="message"></textarea>
    </label>
    <button type="submit">Send</button>
</form>

The form uses method="post", so PHP reads the submitted values from $_POST. The name attributes are important because they become the keys PHP uses.

Validate form input on the server

<?php
$errors = [];
$name = trim($_POST['name'] ?? '');
$email = trim($_POST['email'] ?? '');
$message = trim($_POST['message'] ?? '');

if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    if ($name === '') {
        $errors[] = 'Name is required.';
    }

    if (!filter_var($email, FILTER_VALIDATE_EMAIL)) {
        $errors[] = 'A valid email is required.';
    }

    if (strlen($message) < 10) {
        $errors[] = 'Message must be at least 10 characters.';
    }
}

Validation should happen after submission and before using the data. Client-side validation can improve the user experience, but PHP validation is the part you can trust. Users can disable JavaScript, edit requests, or send data directly to your endpoint.

Escape output before displaying it

When you display user input back on the page, escape it with htmlspecialchars(). This prevents submitted text from being interpreted as HTML.

<?= htmlspecialchars($name, ENT_QUOTES, 'UTF-8'); ?>

This small habit matters. A form that displays unescaped input can accidentally render tags or scripts. Safe output is a core part of PHP form handling, even in beginner examples.

Show errors clearly

<?php if ($errors): ?>
    <ul>
        <?php foreach ($errors as $error): ?>
            <li><?= htmlspecialchars($error, ENT_QUOTES, 'UTF-8'); ?></li>
        <?php endforeach; ?>
    </ul>
<?php endif; ?>

Good error messages tell the user what to fix without exposing private system details. Avoid showing raw database errors, stack traces, or internal paths on public pages.

Beginner checklist

• Use GET for shareable filters and searches.
• Use POST for submissions that change something or include private data.
• Read values with fallback defaults such as $_POST['email'] ?? ''.
• Trim and validate every field on the server.
• Escape output before rendering submitted values.
• Keep form processing readable before moving logic into classes or frameworks.

Preserve user input after validation fails

A helpful form should not erase everything after one mistake. If the email is invalid but the name and message are fine, keep those values in the form so the user only fixes the problem field. This makes the form feel predictable and reduces repeated typing.

<input
    type="text"
    name="name"
    value="<?= htmlspecialchars($name, ENT_QUOTES, 'UTF-8'); ?>"
>

Use the same escaping habit for textareas and selected options. The value came from a request, so treat it as untrusted even when you are only redisplaying it to the same visitor.

Separate validation from the final action

A clean form script has two clear phases. First, collect and validate input. Second, perform the action only when there are no errors. That action might be sending an email, inserting a database row, creating a support ticket, or redirecting to a thank-you page.

<?php
if ($_SERVER['REQUEST_METHOD'] === 'POST' && !$errors) {
    // Send email or save data here.
    header('Location: /thank-you.php');
    exit;
}

This pattern keeps success logic away from error display logic. It also prevents accidental processing when a form has not been submitted yet.

What to learn after basic forms

After simple PHP form handling, learn CSRF protection, file upload validation, prepared statements, and session-based flash messages. Those topics are more advanced, but they build naturally on the same idea: never trust input, validate server-side, escape output, and make the user flow clear.

Once PHP form handling feels clear, the next natural step is saving validated data to a database. That is where PDO, prepared statements, and CRUD workflows enter the picture.