← PHP learning pathPHP · Module 5 of 10
Forms and user input
Handle form submissions safely.
📖 Key ideas
- Form data arrives in $_GET or $_POST.
- Validate input: required fields, formats (filter_var for emails).
- Escape output with htmlspecialchars() to prevent XSS.
- Use CSRF tokens on forms.
- Redirect after successful POST (PRG pattern).
💡 Real-life example: Handling forms is a reception desk: check every visitor's details before letting them in.
$_POSTData from POST forms
filter_varValidates/sanitises values
htmlspecialcharsEscapes HTML output
CSRF tokenProtects form submissions