Summary - Forms

Build a registration form combining form, $_POST and htmlspecialchars.

Summary - Forms

In this group you learned to create a form, read data with $_POST, stop XSS with htmlspecialchars(), validate with empty() and filter_var(), and show error messages.

The flow of a registration page is: show the form → detect submission → read data from $_POST → check empty fields with empty() and the email with filter_var() → collect errors in an array → if no errors, thank the user; otherwise re-show the form and print the errors.

Exercise Process the registration form

Set $_POST['name'] = "";. Set $_POST['email'] = "bad";. Start with $errors = [];. Inside if (empty($_POST['name'])) write $errors[] = "Name required";. Inside if (!filter_var($_POST['email'], FILTER_VALIDATE_EMAIL)) write $errors[] = "Invalid email";. Then inside if ($errors) use foreach ($errors as $error) to write echo $error . "\n";, and in the else block write echo "Welcome, " . htmlspecialchars($_POST['name']) . "!";.

Show example solution

First write $_POST['name'] = ""; and $_POST['email'] = "bad";, start with $errors = [];. Collect errors in two ifs. Then add if ($errors) { foreach ($errors as $error) { echo $error . "\n"; } } else { echo "Welcome, " . htmlspecialchars($_POST['name']) . "!"; }.
Example solution:
<?php
// Process the registration form
$_POST['name'] = "";
$_POST['email'] = "bad";
$errors = [];
if (empty($_POST['name'])) {
    $errors[] = "Name required";
}
if (!filter_var($_POST['email'], FILTER_VALIDATE_EMAIL)) {
    $errors[] = "Invalid email";
}
if ($errors) {
    foreach ($errors as $error) {
        echo $error . "\n";
    }
} else {
    echo "Welcome, " . htmlspecialchars($_POST['name']) . "!";
}

Test yourself

What should the first step in a registration form be?
- Write the form straight to the database
- Trust the user data as is
- Show the form and read data with $_POST
- Ignore the errors
Show answer

Show the form and read data with $_POST — Correct. First show the form; when submitted, read the data with $_POST.
Match the summary concepts

method="post"

Sends data in the body
$_POST['name']

Reads the field value
empty()

Catches empty fields
htmlspecialchars()

Stops XSS

Complete the htmlspecialchars call in the summary

echo ____($_POST['name'], ENT_QUOTES);

Show answer

echo htmlspecialchars($_POST['name'], ENT_QUOTES);

Next lesson: Including files with include

We Are Enhancing Your Experience

Cookie Preferences

Strictly Necessary Cookies

Analytical Cookies