PHP Form Handling: Process, Validate and Redisplay

A PHP form posts back to the script that printed it: write <form method="post"> with named inputs, and when $_SERVER['REQUEST_METHOD'] is 'POST', read each field as $_POST['name']. Escape anything you print back with htmlspecialchars().

Run this block, type a name into the form and press Send: the same script runs again, this time with $_POST filled in.

<?php
$name = '';
if (($_SERVER['REQUEST_METHOD'] ?? 'GET') === 'POST') {
    $name = trim($_POST['name'] ?? '');
}
?>
<form method="post">
  <label>Your name <input name="name" value="<?= htmlspecialchars($name) ?>"></label>
  <button>Send</button>
</form>
<?php if ($name !== ''): ?>
  <p>Hello, <?= htmlspecialchars($name) ?>.</p>
<?php endif; ?>

Three things happen here that every form handler needs:

• The method check. On the first visit the request is a GET and there is nothing to process. ?? 'GET' only matters when the file runs from the command line, where REQUEST_METHOD is not set; on a web server it always is.
• ?? '' on every field. A field can be missing (a renamed input, a request sent by a script), and reading a missing key prints a warning.
• Escaping on output. The name goes back into the page twice, and htmlspecialchars() makes sure a value like <b>Ada</b> is shown as text instead of becoming markup. The details are on the htmlspecialchars page.

Validate a form and show errors next to fields

Collect errors in an array keyed by field name. If the array is empty, the form is valid; otherwise print the form again with each message under its field and the visitor's input still in place. Submit it empty, then with a bad email, then with valid values.

<?php
$values = ['name' => '', 'email' => '', 'age' => ''];
$errors = [];
$sent = false;

if (($_SERVER['REQUEST_METHOD'] ?? 'GET') === 'POST') {
    foreach ($values as $field => $_) {
        $values[$field] = trim((string) ($_POST[$field] ?? ''));
    }

    if ($values['name'] === '') {
        $errors['name'] = 'Please enter your name.';
    } elseif (mb_strlen($values['name']) > 50) {
        $errors['name'] = 'Use 50 characters or fewer.';
    }

    if (filter_var($values['email'], FILTER_VALIDATE_EMAIL) === false) {
        $errors['email'] = 'That does not look like an email address.';
    }

    $age = filter_var($values['age'], FILTER_VALIDATE_INT, ['options' => ['min_range' => 13, 'max_range' => 120]]);
    if ($age === false) {
        $errors['age'] = 'Enter a whole number from 13 to 120.';
    }

    $sent = $errors === [];
}

function e(string $s): string
{
    return htmlspecialchars($s, ENT_QUOTES, 'UTF-8');
}
?>
<style>.err { color: #c62828; margin: 2px 0 10px; } label { display: block; margin-top: 8px; }</style>
<?php if ($sent): ?>
  <p>Thanks, <?= e($values['name']) ?>. We will write to <?= e($values['email']) ?>.</p>
<?php else: ?>
  <form method="post" novalidate>
    <label>Name <input name="name" value="<?= e($values['name']) ?>"></label>
    <?php if (isset($errors['name'])): ?><p class="err"><?= e($errors['name']) ?></p><?php endif; ?>

    <label>Email <input name="email" value="<?= e($values['email']) ?>"></label>
    <?php if (isset($errors['email'])): ?><p class="err"><?= e($errors['email']) ?></p><?php endif; ?>

    <label>Age <input name="age" value="<?= e($values['age']) ?>"></label>
    <?php if (isset($errors['age'])): ?><p class="err"><?= e($errors['age']) ?></p><?php endif; ?>

    <button>Sign up</button>
  </form>
<?php endif; ?>

novalidate turns off the browser's own checks so you can watch the PHP ones work. Keep both in a real form: browser validation is a convenience for the visitor, PHP validation is the one that counts, because anyone can send a request without your form. filter_var() does the email and the integer range in one call each; the filter_var page covers its other filters.

Checkboxes, radio buttons and select

A text field always sends a value, even an empty one. The other controls do not:

• An unchecked checkbox sends nothing at all, so its key is missing from $_POST.
• Checkboxes named topics[] arrive as an array: $_POST['topics'] is ['php', 'sql'].
• A radio group or a <select> sends the value of the chosen option.

To keep the choice after submit, print checked or selected on the option that matches. Tick a few boxes, pick a level and press Save.

<?php
$topics = ['php' => 'PHP', 'sql' => 'SQL', 'js' => 'JavaScript'];
$levels = ['new' => 'New to coding', 'some' => 'Some experience', 'pro' => 'Professional'];

$picked = $_POST['topics'] ?? [];
$picked = is_array($picked) ? array_values(array_intersect($picked, array_keys($topics))) : [];

$level = $_POST['level'] ?? 'new';
if (!is_string($level) || !array_key_exists($level, $levels)) {
    $level = 'new';
}
?>
<form method="post">
  <p>Topics:
  <?php foreach ($topics as $key => $label): ?>
    <label><input type="checkbox" name="topics[]" value="<?= $key ?>"
      <?= in_array($key, $picked, true) ? 'checked' : '' ?>> <?= $label ?></label>
  <?php endforeach; ?>
  </p>
  <p>Level:
    <select name="level">
    <?php foreach ($levels as $key => $label): ?>
      <option value="<?= $key ?>" <?= $key === $level ? 'selected' : '' ?>><?= $label ?></option>
    <?php endforeach; ?>
    </select>
  </p>
  <button>Save</button>
</form>
<p>You picked: <?= $picked ? implode(', ', array_map(fn ($k) => $topics[$k], $picked)) : 'nothing yet' ?>
  (<?= $levels[$level] ?>)</p>

The two checks after reading the input matter more than they look. array_intersect() drops any topic that was not on your list, and the is_string() plus array_key_exists() check puts the level back to a default if someone sends a value you never offered (or an array, which would make $levels[$level] throw). A select limits what a browser can send, not what a request can contain.

Multi-step forms with hidden fields

A hidden input carries a value from one step to the next without showing it. Here step 1 asks for a name, step 2 asks for a language and sends the name along in a hidden field, and step 3 shows both. Go through all three steps.

<?php
$name = trim((string) ($_POST['name'] ?? ''));
$lang = (string) ($_POST['lang'] ?? '');
$step = $name === '' ? 1 : ($lang === '' ? 2 : 3);
$e = fn (string $s) => htmlspecialchars($s, ENT_QUOTES, 'UTF-8');
?>
<p>Step <?= $step ?> of 3</p>
<?php if ($step === 1): ?>
  <form method="post">
    <label>Name <input name="name"></label> <button>Next</button>
  </form>
<?php elseif ($step === 2): ?>
  <form method="post">
    <input type="hidden" name="name" value="<?= $e($name) ?>">
    <p>Hi <?= $e($name) ?>, which language do you want to learn?</p>
    <label><input type="radio" name="lang" value="PHP" checked> PHP</label>
    <label><input type="radio" name="lang" value="Python"> Python</label>
    <button>Next</button>
  </form>
<?php else: ?>
  <p><?= $e($name) ?> wants to learn <?= $e($lang) ?>.</p>
<?php endif; ?>

Hidden fields are visible in the page source and editable like any other field, so they are fine for carrying the visitor's own answers between steps, but never for a price, a user id or a role. Keep those on the server, in a session; see sessions and cookies.

Post/Redirect/Get: stop the resubmit on refresh

After a successful POST, if the script prints a "thank you" page directly, pressing refresh asks the browser to send the POST again, and the order or comment is saved twice. The fix is to save, redirect, and show the result on a GET:

<?php
session_start();

if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    $errors = validate($_POST);
    if (!$errors) {
        save_comment($_POST);
        $_SESSION['flash'] = 'Comment posted.';
        header('Location: /comments.php', true, 303);
        exit;
    }
    // On errors, fall through and print the form with the messages.
}

$flash = $_SESSION['flash'] ?? null;
unset($_SESSION['flash']);

303 See Other tells the browser to follow the redirect with a GET. exit after header() matters: without it the rest of the script keeps running. The redirect also has to happen before any output, or PHP refuses with "headers already sent".

Real forms also add a CSRF token: a random value stored in the session and in a hidden field, compared with hash_equals() on submit, so another site cannot post to your form on a logged-in visitor's behalf.

Test the validation without a browser

Put the rules in a function that takes an array and returns the errors. The page calls it with $_POST, and you can call it with any array you like, which makes the edge cases easy to try. Add your own cases to the list.

<?php
function validateSignup(array $input): array
{
    $errors = [];
    $name = $input['name'] ?? '';
    $email = $input['email'] ?? '';

    if (!is_string($name) || trim($name) === '') {
        $errors['name'] = 'required';
    }
    if (!is_string($email) || filter_var($email, FILTER_VALIDATE_EMAIL) === false) {
        $errors['email'] = 'invalid';
    }
    return $errors;
}

$cases = [
    ['name' => 'Ada', 'email' => 'ada@example.com'],
    ['name' => '   ', 'email' => 'ada@example.com'],
    ['name' => 'Ada', 'email' => 'ada@'],
    ['name' => ['x'], 'email' => 'ada@example.com'],
    [],
];

foreach ($cases as $case) {
    echo json_encode($case), ' => ', json_encode(validateSignup($case)), "\n";
}

The fourth case is the one people forget. A request can send name[]=x, which makes $_POST['name'] an array, and passing an array to trim() throws a TypeError and stops the script. Checking is_string() first turns hostile input into an ordinary validation error. The (string) cast in the earlier blocks avoids the TypeError too, but it turns the array into the word Array and prints a warning, so is_string() is the cleaner check.

Common mistake: reading $_POST before the form is sent

The most common first form script reads the fields at the top of the file:

<?php
$name = $_POST['name'];
echo "Hello, $name";

On the first visit nothing has been posted, so PHP prints:

Warning: Undefined array key "name" in /var/www/form.php on line 2

The fix is the pattern from the first block: process the form only when the request is a POST, and read every field with a default, $_POST['name'] ?? ''. If the warning appears after submitting, compare the name attribute in the HTML with the key in PHP: name="Name" and $_POST['name'] are different keys.