1. Week 7. Lecture 3 PHP Forms

2. PHP forms In part 2 of this course, we discussed html forms, php form is similar. Lets do a quick recap of the things we need to remember. The Form element takes the method and action attributes. Action specifies where the form is sent when submitted and method specifies the http method to be used to send the form. GET and POST are the two most used http methods. Use GET when the information you are sending is not sensitive because all variables and values are displayed in the address bar. The maximum number of characters that can be sent via GET is 2000. One advantage of using GET is that the page can be bookmarked. Use POST when the information you are sending is sensitive. Unlimited number of characters can be sent via post.

3. The super global $_GET and $_POST are used to collect form data in PHP. $_GET is used when the http method used for the form is GET and $_POST is used when the http method used for the form is POST. Now let’s launch wamp server and open the www directory to do some practicals. Open your php folder and create a pages folder in it. Save a new notepad document in it and give it the name register.php, write the following on the page.

4. .error {color: #FF0000;} <?php // define variables and set to empty values $firstnameErr = $lastnameErr = $middlenameErr =$emailErr = $genderErr =""; $firstname = $lastname =$middlename = $email = $gender = ""; //check if the submit button was clicked if ($_SERVER["REQUEST_METHOD"] == "POST") { if (empty($_POST["firstname"])) { $firstnameErr = "first name is required"; } else { $firstname = test_input($_POST["firstname"]); // check if name only contains letters and whitespace if (!preg_match("/^[a-zA-Z ]*$/",$firstname)) { $firstnameErr = "Only letters and white space allowed"; }

5. if (empty($_POST["lastname"])) { $lastnameErr = "last name is required"; } else { $lastname = test_input($_POST["lastname"]); // check if name only contains letters and whitespace if (!preg_match("/^[a-zA-Z ]*$/",$lastname)) { $lastnameErr = "Only letters and white space allowed"; } if (empty($_POST["middlename"])) { $middlenameErr = "middle name is required"; } else { $middlename = test_input($_POST["middlename"]); // check if name only contains letters and whitespace if (!preg_match("/^[a-zA-Z ]*$/",$middlename)) { $middlenameErr = "Only letters and white space allowed"; }

6. if (empty($_POST["email"])) { $emailErr = "Email is required"; } else { $email = test_input($_POST["email"]); // check if e-mail address is well-formed if (!filter_var($email, FILTER_VALIDATE_EMAIL)) { $emailErr = "Invalid email format"; } if (empty($_POST["sex"])) { $genderErr = "Gender is required"; } else { $gender = test_input($_POST["sex"]); }

7. function test_input($data) { $data = trim($data); $data = stripslashes($data); $data = htmlspecialchars($data); return $data; } ?> Registration form * required field. <form method="post" action="<?php echo htmlspecialchars($_SERVER["PHP_SELF"]);?>"> First Name: "> * Last Name: "> * Middle Name: "> * E-mail: "> *

8. Gender: value="female">Female value="male">Male * <?php echo " Below is the information you entered "; echo "first name: ".$firstname; echo " "; echo "last name: ".$lastname; echo " "; echo "middle name: ".$middlename; echo " "; echo "your email address is: ".$email; echo " "; echo "you are a: ".$gender; ?>

9. Explanation of the registration form. Because our form method is post, we use $_POST super global to access the form. The validation rule for the form is that all fields must be filled, the email must be valid and gender must be selected. The super global $_SERVER[“PHP_SELF”] returns the file name of the currently executing script. The form data is submitted to itself instead of a new page. this way the user will get error messages on the same page as the form. This super global can be exploited. To prevent cross site scripting attacks, the htmlspecialchars() function is used to convert special characters to html entities.

10. htmlspecialchars(): this function converts special characters to HTML entities and prevents attackers from exploiting the code by injecting scripts in forms. (prevents XSS attacks). trim(): the trim function removes extra spaces, tabs and newline from the user input data. stripslashes(): this function removes backslashes from user input. The function test_input that we have written uses the functions mentioned above to perform its functions on the input.