Processing a form submission is one of the single most common things PHP is used for — a visitor fills in fields, submits, and PHP reads what they typed.
An HTML <form>'s method attribute decides which superglobal PHP receives the data in. GET puts the data visibly in the URL (good for search, filters — anything shareable or bookmarkable); POST sends it hidden in the request body (required for anything sensitive, or that changes data, like a login or a purchase).
<form action="process.php" method="post">
<input type="text" name="username">
<input type="email" name="email">
<button type="submit">Submit</button>
</form><?php
// process.php
$username = $_POST["username"] ?? "";
$email = $_POST["email"] ?? "";
if ($username && $email) {
echo "Thanks, $username! We'll email you at $email.";
} else {
echo "Please fill in both fields.";
}
?>The ?? "" pattern from the Control Flow lesson matters here specifically: if someone reaches process.php directly, without submitting the form, $_POST["username"] won't exist at all — reading it without a fallback would produce a warning instead of a clean, handled case.
A common, simpler pattern for small scripts: one file that shows the form and processes it, checking the request method to decide which:
<?php
if ($_SERVER["REQUEST_METHOD"] === "POST") {
$name = $_POST["name"] ?? "";
echo "Hello, $name!";
} else {
?>
<form method="post">
<input type="text" name="name">
<button type="submit">Submit</button>
</form>
<?php
}
?>Validation is coming, in context
Nothing here checks whether $name actually contains something safe to display or store — that's deliberate, to keep this lesson focused on the mechanics of receiving form data. The PHP and MySQL lessons later in this section cover the specific, most important case: never building a database query by directly pasting form data into it.