PHP
Adding posts with a form
Learn to create new posts with an HTML form and $_POST.
Reading data with an HTML form
When adding a post to a blog, the user fills in an HTML form. When the form is sent with method="post", PHP gathers the fields in the $_POST superglobal. A field with name="title" shows up on the PHP side as $_POST['title'].
To avoid errors when a field is missing, you give an empty string default with ?? '': $title = $_POST['title'] ?? '';. This null coalescing operator uses the right-hand value when the key is absent.
Creating a Post instance from $_POST
You take the title, content and author from the form and create a new Post instance with new Post($title, $content, $author). But printing the user's text directly is unsafe; an <script> tag can launch an XSS attack.
To prevent this you use htmlspecialchars(): $title = htmlspecialchars($_POST['title'] ?? '');. This function turns characters like <, >, & into HTML entity names, so the text is printed safely.
Exercise Create a Post instance from $_POST
The Post class is ready. Now create a new Post from form data. Set test data by hand with $_POST = ['title' => 'New post', 'content' => 'Content here', 'author' => 'Ayşe']; (for CLI). Then write $title = htmlspecialchars($_POST['title'] ?? ''); and the same pattern for $content and $author. Create the instance with $p = new Post($title, $content, $author); and print with echo $p->title . " - " . $p->author;.
Show example solution
Set test data with $_POST = ['title' => 'New post', 'content' => 'Content here', 'author' => 'Ayşe'];. Write $title = htmlspecialchars($_POST['title'] ?? '');, $content = htmlspecialchars($_POST['content'] ?? ''); and $author = htmlspecialchars($_POST['author'] ?? '');. Create the instance with $p = new Post($title, $content, $author); and print with echo $p->title . " - " . $p->author;.
Example solution:
<?php
// Create a new Post instance from form data
class Post {
public string $title = "";
public string $content = "";
public string $author = "";
public function __construct(string $title, string $content, string $author) {
$this->title = $title;
$this->content = $content;
$this->author = $author;
}
}
$_POST = ['title' => 'New post', 'content' => 'Content here', 'author' => 'Ayşe'];
$title = htmlspecialchars($_POST['title'] ?? '');
$content = htmlspecialchars($_POST['content'] ?? '');
$author = htmlspecialchars($_POST['author'] ?? '');
$p = new Post($title, $content, $author);
echo $p->title . " - " . $p->author;
Test yourself
-
Why use htmlspecialchars?
- To write text shorter
- To connect to a database
- To make special characters in user input safe
- To change the form's method attribute
Show answer
To make special characters in user input safe — Correct. htmlspecialchars turns characters like < > and & into HTML entity names, preventing XSS attacks.
-
Read the title field from $_POST
$title = htmlspecialchars(____['title'] ?? '');
Show answer
$title = htmlspecialchars($_POST['title'] ?? '');
-
Match the form processing concepts
- method="post"
- Form send method
- $_POST['title']
- Title field
- htmlspecialchars
- Escape function
- new Post(...)
- Post instance
Next lesson: Displaying the post list
