Challenge - Secure feedback form

PHP course · Beginner · Lesson 113/116

Build a secure feedback form with an HTML form, $_POST and htmlspecialchars.

Challenge - Secure feedback form

In this challenge you'll write a function that processes a feedback form. The processFeedback(array $data): string function validates the name and message from the form and prepares them for safe output.

If a field is empty you return an error message. For filled fields you escape them with htmlspecialchars to prevent XSS. This combines form validation and output security.

$_POST and htmlspecialchars refresher

You read form data from the $_POST superglobal; each field is a key. A user may enter dangerous text like <script>; before printing it you escape it with htmlspecialchars.

To check for empty fields you compare with === ""; with ?? you give a default for missing keys. In this challenge processFeedback will do both validation and escaping.

Exercise Write the secure feedback handler

Define processFeedback(array $data): string. Get the values with $name = $data["name"] ?? "" and $message = $data["message"] ?? "". If either is === "", return "Error: name and message required". Otherwise escape both with htmlspecialchars($name, ENT_QUOTES, "UTF-8") and return $safeName . ": " . $safeMessage. Then add three echo calls: ["name" => "Alex", "message" => "Great"], ["name" => "<b>", "message" => "hi"] and ["name" => "", "message" => ""]; append "\n" to each line.

Show example solution

Use $data["name"] ?? "" for a default on missing keys; check emptiness with === ""; escape with htmlspecialchars($name, ENT_QUOTES, "UTF-8").
Example solution:
<?php
// Write processFeedback
function processFeedback(array $data): string {
    $name = $data["name"] ?? "";
    $message = $data["message"] ?? "";
    if ($name === "" || $message === "") {
        return "Error: name and message required";
    }
    $safeName = htmlspecialchars($name, ENT_QUOTES, "UTF-8");
    $safeMessage = htmlspecialchars($message, ENT_QUOTES, "UTF-8");
    return $safeName . ": " . $safeMessage;
}

echo processFeedback(["name" => "Alex", "message" => "Great"]) . "\n";
echo processFeedback(["name" => "<b>", "message" => "hi"]) . "\n";
echo processFeedback(["name" => "", "message" => ""]) . "\n";

Test yourself

What is htmlspecialchars for?
- Escapes HTML special characters, preventing XSS
- Stores form data in a database
- Auto-fills form fields
- Deletes empty fields
Show answer

Escapes HTML special characters, preventing XSS — Correct. htmlspecialchars turns <, > and quotes into HTML entities, preventing XSS attacks.

Complete the htmlspecialchars call

$safe = htmlspecialchars($name, ____, "UTF-8");

Show answer

$safe = htmlspecialchars($name, ENT_QUOTES, "UTF-8");

Match the form concepts

$_POST

form data
htmlspecialchars

XSS protection
null coalesce

default value
validation

empty field check

Challenge - Secure feedback form