Forms and Files - Study Notes

Chapter Summary

This chapter shows how an HTML form and a PHP script work together to collect, check and process what a user types. Form controls such as text boxes, buttons, checkboxes, radio buttons, drop-down lists and file inputs gather the data, and the browser sends it to the web server using either the POST method, which puts the data in the body of the request, or the GET method, which adds it to the URL. The second half of the chapter covers file handling in PHP: opening, reading, writing, appending, closing and uploading files on the server.

Learning Objectives

• Explain what HTML forms are used for in web applications.
• Describe how form data reaches the server and how PHP reads it with superglobal arrays.
• Tell the difference between client-side and server-side validation.
• Use PHP's file handling functions with the correct syntax.
• Build a form that uploads a file using the right form attributes.

Key Concepts and Definitions

• HTML Form: The part of a web page that collects user input and sends it to a server-side script for processing.
• POST Method: An HTTP method that sends form data in the body of the request, so it does not appear in the address bar. It suits passwords and large amounts of data, but the data is not encrypted unless the site uses HTTPS.
• GET Method: An HTTP method that attaches form data to the URL as a query string, visible to anyone who sees the address. It is used for small, non-sensitive data such as a search word.
• Client-Side Validation: Checking input inside the user's browser, using HTML5 attributes or JavaScript, before the data is sent.
• Server-Side Validation: Checking input on the server after the form is submitted, so that invalid or harmful data is caught even if browser checks were skipped.
• File Handle: The resource returned by fopen() that points to an open file. Functions like fread() and fwrite() use it to work on that file.

Worked Methods

1. Collecting Form Input in PHP

Give every input element a name attribute. When the form is submitted to a PHP script, the script reads each value from a superglobal associative array, using that name as the key:

• For forms using the POST method: $_POST['input_name']
• For forms using the GET method: $_GET['input_name']

2. Server-Side File Handling Sequence

Working with a file in PHP follows the same four steps each time:

1. Open the file: Call fopen() with the file path and a mode, such as 'r' to read or 'w' to write.
2. Check that it opened: Make sure fopen() did not return false before you go further.
3. Read or write: Use fread() to read the contents or fwrite() to store data.
4. Close the file: Call fclose() to release the file handle and free the server's resources.

Common Exam Traps

• POST vs. GET: GET shows all the data in the address bar and the URL length is limited. POST carries the data in the request body, so it is not shown in the URL and is not held back by URL length; only the server sets a maximum size.
• Forgetting fclose(): A file left open keeps its handle on the server, which wastes resources and can stop other scripts from using the file.
• Trusting only client-side checks: A user can switch off JavaScript or send data without using the form at all, so browser validation is easy to get around. Always validate again on the server.
• File size in fread(): fread() needs a second argument giving how many bytes to read. To read the whole file, pass filesize() of that file; a smaller number gives you only part of the contents.

Exam Tips

• In a form-handling program, make sure the action attribute names the correct PHP file and the method attribute matches the array you read ($_POST or $_GET).
• Check what fopen() returns. If the file cannot be opened, stop with a message using die().
• A file upload form must have enctype="multipart/form-data" in its form tag, along with method POST. Without it the file is not sent.
• Practise short validation code, such as using PHP's empty() function to check that a required field was filled.