PHP Form Processing

Using Forms in PHP  Two steps to process  Display the form  Process the submitted data

Program Structure if (array_key_exists( 'elementName', $_POST)) // process submitted data else // display the form

Using Forms in PHP  The form can use either the POST method or the GET method  The action for the form is a php file (either the one that displays the form or a different one)

Post or Get?  If the GET method is used, data from the form is included at the end of the URL of the php file that will process the data  If the post method is used, form data is sent as input to the program  In either case, the data will be stored in the appropriate autoglobal array

Server variables $_POST is an array containing post data $_GET contains data if the GET method is used $_SERVER is an array which makes information about the server and the request available to the program  PHP_SELF, QUERY_STRING, PATH_INFO, SERVER_NAME, DOCUMENT_ROOT, REMOTE_ADDR, REMOTE_HOST, HTTP_REFERER, HTTP_USER_AGENT

Data Validation  PHP can be used to validate form data  The form data is sent to the server to be validated

Program Structure if (array_key_exists( 'elementName', $_POST)) if (validateForm()) // process data else // redisplay form else // display the form

Validation techniques  Check the length ( strlen ) of string to make sure something was entered  use trim() first to remove leading and trailing space  Check numeric data by comparing the original with converted value strval( intval( $input)) strval( floatval( $input))  Do any necessary range checking

Validating Addresses Use a regular expression to check for valid format for addresses $pattern = if (! preg_match($pattern,$_POST[' '])) { $errors[] = 'Please enter a valid address'; }

Sanitizing Input  What happens if a user types HTML code (or JavaScript code) into a textarea?  PHP provides two functions for cleaning up input  strip_tags() removes all HTML tags and leaves the content  htmlentities() converts HTML special characters to corresponding entity

Displaying Default values if ($_POST['_submit_check']) { $defaults = $_POST; } else { $defaults = array('delivery' => 'yes', 'size' => 'medium', 'main_dish' => array('taro','tripe'), 'sweet' => 'cake'); }

Running Shell Commands  PHP provides the shell_exec() function for running an external program from the php program $filelist = shell_exec( 'ls');  If you are passing form input on to another program, use escapeshellargs() to clean it up first

Extensions  The mycrypt extension to PHP provides a number of standard encryption algorithms  The Perl and Java extensions allow you to execute code written in those languages from your PHP program  PEAR is an extension that is useful for applications that use databases  more next time

Sources  Learning PHP 5 by David Sklar  PHP home page 