PHP Forms and User Input

If you type some characters in the text field below, and click the “Submit” button, the browser will send your input to a page called action_page.php. The page will show you the received input.

view source
print?
1<form name="input" action="action_page.php" method="get">
2  Username:
3  <input type="text" name="firstname">
4  <input type="submit" value="Submit">
5</form>
How it looks in a browser:     Username:  

The $_GET and $_POST variables are used to retrieve user information from forms. The example below shows the web input is saved in the variable $_POST['string'] by using a POST method, where the strtolower(string) function converts a string to lowercase. The print_r(mixed $expression) function displays information about a variable in a way readable by humans.

HTML
print_r.php
view source
print?
1<form method="post" action="print_r.php">
2 $string = <input type="text"
3   name="string" size="25"
4   value="This is only a Test.">
5 <input type="submit" name="act"
6   value="Check">
7</form>
view source
print?
1<html><body>
2<?php
3 print_r ( $_POST );
4 echo strtolower(
5   $_POST['string'] );
6?>
7</body></html>
  $string =    
Form Validation
User input should be validated whenever possible. Client side validation is faster, and will reduce server load. However, any site that gets enough traffic to worry about server resources, may also need to worry about site security. You should always use server side validation if the form accesses a database.