Handling a Form with $_POST

Until now, data has flowed one way: from your code to the visitor. Real websites flow both ways. Sign-up forms, comment boxes, search bars, checkout pages, every one of them is a visitor sending data to your PHP. Let's receive it.

The HTML side: a form

<form method="post" action="greet.php">
    <label>Your name:</label>
    <input type="text" name="visitor_name">
    <button type="submit">Say hello</button>
</form>

Three attributes make the magic happen:

• method="post" says how to send the data. POST tucks it inside the request, which is right for anything that submits or changes information.
• action="greet.php" says which PHP file receives the submission.
• name="visitor_name" is the crucial one for you: it is the label the data travels under. An input without a name attribute sends nothing at all.

The PHP side: $_POST

When the visitor clicks the button, the browser sends the form to greet.php, and PHP places every submitted field into a special associative array called $_POST. And you already know exactly how to read an associative array:

<?php
$name = $_POST["visitor_name"];
echo "Hello, " . $name . "!";
?>

The key in $_POST matches the name attribute from the HTML. Type Ada into the box, click the button, and the page replies Hello, Ada!. That round trip, form to server to personalized response, is the beating heart of the interactive web.

Never trust the box to be filled

Here is your first taste of defensive programming: visitors do surprising things. They submit empty forms. They arrive at greet.php directly without submitting anything. Solid PHP always checks before reaching into $_POST:

<?php
if ($_SERVER["REQUEST_METHOD"] === "POST" && !empty($_POST["visitor_name"])) {
    $name = $_POST["visitor_name"];
    echo "Hello, " . $name . "!";
} else {
    echo "Please tell us your name first.";
}
?>

Two checks, joined with the && you learned earlier. $_SERVER["REQUEST_METHOD"] tells you whether a form was actually posted, and empty() answers whether the field has anything usable in it. The ! in front flips it, so !empty(...) reads as: is not empty. Only when both checks pass do we touch the data.

What about $_GET?

Forms can also use method="get", which puts the data in the page's address, like search.php?query=mugs, and delivers it in an array called $_GET. The rule of thumb: GET for searches and links people might bookmark or share, POST for submitting, changing, or anything private.