Handling POST Requests in PHP: A Beginner's Guide

Previously in this course, we explored Processing GET Requests, where we learned to retrieve data from URL query strings. While GET is perfect for filtering or searching, it's unsuitable for sending sensitive information like passwords or large chunks of data. In this lesson, we shift to Handling POST Requests, which allows us to submit data invisibly and securely via HTML forms.

Understanding the POST Method

When a browser sends a GET request, the data is appended directly to the URL. This makes the request bookmarkable and visible in history—great for search, terrible for account registration.

A POST request, by contrast, includes data in the body of the HTTP request. This is the standard way to handle "state-changing" actions: signing up, posting a comment, or updating a user profile. In PHP, this data is automatically populated into the $_POST superglobal array.

Creating the HTML Form

To send data via POST, we define an HTML <form> with the method="POST" attribute. Without this attribute, browsers default to GET.

HTML
<!-- views/contact.php -->
style="color:#808080"><style="color:#4EC9B0">form action="submit.php" method="POST">
    style="color:#808080"><style="color:#4EC9B0">label for="username">Username:style="color:#808080"></style="color:#4EC9B0">label>
    style="color:#808080"><style="color:#4EC9B0">input type="text" name="username" id="username">

    style="color:#808080"><style="color:#4EC9B0">label for="email">Email:style="color:#808080"></style="color:#4EC9B0">label>
    style="color:#808080"><style="color:#4EC9B0">input type="email" name="email" id="email">

    style="color:#808080"><style="color:#4EC9B0">button type="submit">Sendstyle="color:#808080"></style="color:#4EC9B0">button>
style="color:#808080"></style="color:#4EC9B0">form>

Key points here:

1. action: Specifies the PHP script that will process the data.
2. method="POST": Tells the browser to send data in the request body.
3. name attributes: These become the keys in your $_POST array. If your input has name="username", you access it in PHP via $_POST['username'].

Processing Input with $_POST

Once the user clicks "Send," the browser makes a request to submit.php. Inside that script, we check if the request actually contains data using $_SERVER['REQUEST_METHOD'].

PHP
#6A9955">// submit.php
if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    #6A9955">// Access individual inputs using the keys defined in the HTML form
    $username = $_POST['username'] ?? 'Guest';
    $email = $_POST['email'] ?? '';

    echo "Hello, " . htmlspecialchars($username) . "! We received your email: " . htmlspecialchars($email);
} else {
    #6A9955">// Redirect or show error if someone tries to access this script directly via URL
    echo "Please submit the form first.";
}

Notice the use of the null coalescing operator (??). This provides a fallback value if the user managed to trigger the script without filling out the fields, preventing "undefined index" errors. We also wrap the output in htmlspecialchars() to prevent basic Cross-Site Scripting (XSS)—a vital habit when echoing user input.

Hands-on Exercise: Building a Feedback Form

In your project directory, create a feedback.php file containing the HTML form provided above. Then, create a process-feedback.php file that:

1. Checks if the request method is POST.
2. Captures a message field from the form.
3. Outputs a confirmation message back to the browser.

Common Pitfalls

• Forgetting method="POST": If you leave this out, your form defaults to GET, and your $_POST array will be empty.
• Missing name attributes: PHP cannot "see" an input if it doesn't have a name attribute. The browser simply won't send the value.
• Assuming input exists: Never access $_POST['key'] directly without checking if it exists or using a fallback. Doing so will trigger a PHP Notice.
• Trusting User Input: Never save raw $_POST data directly to a database or use it in logic without validation. While we discuss this in Sanitization and Validation, always remember that $_POST is user-supplied data—treat it as hostile.

FAQ

Can I use both GET and POST in the same form? Yes, you can have a URL like submit.php?ref=sidebar with method="POST". PHP will populate both $_GET and $_POST simultaneously.

What is the limit on POST data size? Technically, it's limited by your server configuration (post_max_size in php.ini). For standard form text, this is never an issue.

How do I handle file uploads? File uploads require a special enctype="multipart/form-data" attribute on the form and use the $_FILES superglobal, which we will cover later in the course.

Recap

We've moved from passive URL parameters to active data submission. By creating HTML forms with method="POST" and capturing them with the $_POST superglobal, you've gained the ability to accept complex user interactions. Always remember to check your request methods and sanitize your data before use.

Up next: Sanitization and Validation — ensuring the data you receive is clean, safe, and exactly what you expect.