(X)HTML Forms and PHP

Jussi Pohjolainen

Tampere University of Applied Sciences

Http

• HTTP (Hypertext transfer protocol [RFC2616]) is a stateless protocol, which is meant to transfer html-documents.
• Clients and Servers. Client is also referred as user agent.
• HTTP consists of requests and responses
• Connection is established using TCP connection to a particular port
• HTTP server listens to requests in default port 80.
• When requesting a web page, the method of the request is defined. Method can be GET, POST, HEAD, PUT etc., where GET is most common method. Also requested resource must be specified using URI.
• Request consists of header and body. All the responses and requests are text.

HTTP GET

telnet www.uta.fi 80
Trying 153.1.6.41...
Connected to www.uta.fi.
Escape character is '^]'.
GET / HTTP/1.0

HTTP/1.1 200 OK
Date: Fri, 12 Jan 2007 07:51:41 GMT
Server: Apache/1.3.37 (Unix)
Last-Modified: Wed, 10 Jan 2007 12:43:34 GMT
ETag: "479a0-16a9-45a4df76"
Accept-Ranges: bytes
Content-Length: 5801
Connection: close
Content-Type: text/html; charset=iso-8859-1

(X)HTML Forms and HTTP

• (X)HTML form generates a request to the server.
• Form information is attached either to the requests URI (GET) or body (POST)
• Simple form:

  • <form action="examples/process.php" method="GET">
    	<p>Name
    	<input type="text" name="name" />
    	<input type="submit" value="Send" /></p>		
    </form>
    

    Looks like in browser:

    Name:

• When clicking the submit-button, users name is attached to the URI:
examples/process.php?name=Bill, See: Get-example

Difference between GET and POST

• In usage perspective (rfc2616):
  • HTTP Protocol specifies different usages for these two methods
  • GET requests should be idempotent on the server. This means that GET request should not change some state on the server.
  • POST request are safer when request is changing the state of the web app.
  • Why? It is very easy to make repeated entries via GET (For example pushing the reload-button). If using the POST-method, browser asks the user if he/she is really sure that he/she wants to send the request again
• In technical perspective:
  • GET: sending information via URI, POST: sending information via request body

Handling forms in PHP

• It is very easy to handle the sent (GET or POST) information in PHP.
• Information is stored in assoacitive array called GET, POST and REQUEST
• Array keys are defined form names and values are the users input
• Getting input in PHP:
  • $name = $_GET['name']; (If input is sent via GET)
  • $name = $_POST['name']; (If input is sent via POST)
  • $name = $_REQUEST['name']; (If input is sent via GET or POST)

Examples of using GET and POST

• GET - example
• POST and validating user input
• Simple "Guess number"-game

Example forms

<form action="foo.php" method="POST">
 <input type="radio" name="choice" value="coffee">Coffee
 <input type="radio" name="choice" value="tea">Tea<br/>
</form>

$ch = $_GET['choice'];

<form action="foo.php" method="GET">
 <input type="checkbox" name="pizza"> Pizza
 <input type="checkbox" name="coke"> Coca-Cola<br/>
</form>

if(isset($_GET['pizza'])) 
{ 
   ... 
}

<form action="foo.php" method="GET">
  <select name="drink">
	<option>Beer</option>
	<option>Wine</option>
  </select>
</form>

$ch = $_GET['drink'];

Sending information to the same page

• It is possible that the page sends information to itself.
• => PHP and static xhtml-form exists on the same page.
• Simple example: Guess Number - game
• Complex example: Encapsulating user input (Uses OOP-techniques)

Hidden information in forms

• Hidden value indicates that the field is hidden.
• It gives the possibility to hide information in a form.
• Hidden value is submitted with other information when the user clicks the submit-button.
• Example of hidden value.