PHP Form Handling: GET vs POST Methods, Validation & Web Security

HTML forms are the universal bridge between website visitors and backend web servers. Whether a user is logging into a student portal, submitting an examination assignment, or leaving a blog comment, PHP processes form data seamlessly. However, handling form data properly requires understanding the critical architectural differences between GET and POST methods, robust server-side data validation, and bulletproof sanitization against Cross-Site Scripting (XSS) attacks.

GET vs POST: The Definitive Comparison

Complete Working Example: Secure Student Registration Form

Here is a production-grade self-processing PHP form featuring server-side validation and sanitization:

<?php
    $name = $email = $course = "";
    $nameErr = $emailErr = "";
    $successMsg = "";

    // Check if form was submitted via HTTP POST
    if ($_SERVER["REQUEST_METHOD"] === "POST") {

        // 1. Validate & Sanitize Name
        if (empty($_POST["full_name"])) {
            $nameErr = "Student name is required.";
        } else {
            // htmlspecialchars prevents XSS; trim removes extra spaces
            $name = htmlspecialchars(trim($_POST["full_name"]));
            if (!preg_match("/^[a-zA-Z-' ]*$/", $name)) {
                $nameErr = "Only letters and spaces allowed in name.";
            }
        }

        // 2. Validate & Sanitize Email
        if (empty($_POST["email"])) {
            $emailErr = "Email address is required.";
        } else {
            $email = filter_var(trim($_POST["email"]), FILTER_SANITIZE_EMAIL);
            if (!filter_var($email, FILTER_VALIDATE_EMAIL)) {
                $emailErr = "Invalid email format entered.";
            }
        }

        // 3. Process If No Validation Errors
        if (empty($nameErr) && empty($emailErr)) {
            $course = htmlspecialchars($_POST["course"]);
            $successMsg = "Registration Successful! Welcome, $name ($course).";
            // In a live app, insert securely into database via PDO here!
        }
    }
?>

<!-- HTML Form -->
<?php if ($successMsg): ?>
    <div class="alert alert-success"><?= $successMsg ?></div>
<?php endif; ?>

<form method="POST" action="<?= htmlspecialchars($_SERVER["PHP_SELF"]); ?>">
    <div class="form-group">
        <label>Full Name:</label>
        <input type="text" name="full_name" value="<?= $name ?>" class="form-control">
        <span style="color:red;"><?= $nameErr ?></span>
    </div>

    <div class="form-group">
        <label>Email Address:</label>
        <input type="email" name="email" value="<?= $email ?>" class="form-control">
        <span style="color:red;"><?= $emailErr ?></span>
    </div>

    <div class="form-group">
        <label>Select Degree Course:</label>
        <select name="course" class="form-control">
            <option value="BCA">BCA (Computer Applications)</option>
            <option value="B.Tech CS">B.Tech Computer Science</option>
            <option value="BSc IT">BSc Information Technology</option>
        </select>
    </div>

    <button type="submit" class="btn btn-primary">Submit Registration</button>
</form>

BCA / CS University Exam Corner

Interactive Student Practice Session