Forms & User Input 📝

<?php
// When a browser submits a form, PHP fills one of these "superglobals"
// (built-in arrays you can read anywhere). In a real app the browser sets
// them; here we assign them directly so the example runs anywhere.

// A form with method="get" puts data in the URL  ?q=php&page=2
$_GET = ["q" => "php", "page" => "2"];

// A form with method="post" sends data in the request body (not the URL)
$_POST = ["username" => "ada", "password" => "secret"];

echo "From the URL (GET):\n";
echo "  search term: " . $_GET["q"] . "\n";     // php
echo "  page number: " . $_GET["page"] . "\n";  // 2

echo "\nFrom the form body (POST):\n";
echo "  username: " . $_POST["username"] . "\n"; // ada

// $_REQUEST merges GET + POST (+ cookies). Convenient, but you lose track of
// WHERE data came from — prefer the specific $_GET or $_POST in real code.
echo "\n$_REQUEST also sees it: " . $_REQUEST["username"] . "\n";
?>

From the URL (GET):
  search term: php
  page number: 2

From the form body (POST):
  username: ada

$_REQUEST also sees it: ada

<?php
// A user typed a comment containing a <script> tag — a classic XSS attempt.
// "XSS" (cross-site scripting) is when attacker HTML runs in another user's
// browser. Escaping the output is what stops it.
$_POST = ["comment" => "Nice post! <script>steal(cookies)</script>"];

// 1) Read safely. The ?? operator gives a fallback if the key is missing,
//    so you never hit an "Undefined array key" warning.
$raw = $_POST["comment"] ?? "";

// 2) trim() removes leading/trailing spaces a user often leaves behind.
$raw = trim($raw);

// 3) htmlspecialchars() turns < > " ' & into harmless entities so the
//    browser DISPLAYS the tag as text instead of RUNNING it.
$safe = htmlspecialchars($raw, ENT_QUOTES, "UTF-8");

echo "Raw (dangerous):  $raw\n";
echo "Safe (escaped):   $safe\n";
// Notice <script> became &lt;script&gt; — it can no longer execute.
?>

Raw (dangerous):  Nice post! <script>steal(cookies)</script>
Safe (escaped):   Nice post! &lt;script&gt;steal(cookies)&lt;/script&gt;

<?php
// Sanitizing makes input SAFE to display. Validating checks it's CORRECT.
// You almost always do both: sanitize, then validate.
$_POST = [
    "name"  => "  Alice  ",
    "email" => "alice@example.com",
    "age"   => "28",
];

$errors = [];                                   // collect problems as we go

// Required field: must not be empty after trimming.
$name = trim($_POST["name"] ?? "");
if ($name === "") {
    $errors[] = "Name is required";
}

// filter_var validates common types WITHOUT writing your own regex.
$email = filter_var($_POST["email"] ?? "", FILTER_VALIDATE_EMAIL);
if ($email === false) {                         // returns false when invalid
    $errors[] = "A valid email is required";
}

// Validate an integer AND a range in one call.
$age = filter_var($_POST["age"] ?? "", FILTER_VALIDATE_INT, [
    "options" => ["min_range" => 13, "max_range" => 120],
]);
if ($age === false) {
    $errors[] = "Age must be a whole number from 13 to 120";
}

if (empty($errors)) {                           // empty() is true for []
    echo "All good! Welcome, $name ($age).\n";
} else {
    echo "Please fix:\n";
    foreach ($errors as $e) {
        echo "  - $e\n";
    }
}
?>

All good! Welcome, Alice (28).

<?php
// "Sticky" forms keep what the user typed when validation fails, so they
// don't have to retype everything. The golden rule: ALWAYS escape a value
// before putting it back into HTML, or you reopen the XSS hole.
$_POST = ["name" => 'Bob "the builder"', "email" => "not-an-email"];

$name  = trim($_POST["name"] ?? "");
$email = trim($_POST["email"] ?? "");
$valid = filter_var($email, FILTER_VALIDATE_EMAIL) !== false;

// A tiny helper so we never forget to escape when re-displaying.
function safe(string $v): string {
    return htmlspecialchars($v, ENT_QUOTES, "UTF-8");
}

// This is the HTML PHP would send back to the browser on a failed submit:
echo '<input name="name"  value="'  . safe($name)  . '">' . "\n";
echo '<input name="email" value="' . safe($email) . '">' . "\n";
if (!$valid) {
    echo '<p class="error">Please enter a valid email.</p>' . "\n";
}
// The quote in 'Bob "the builder"' became &quot; so it can't break out of
// the value="..." attribute. That's exactly why you escape.
?>

<input name="name"  value="Bob &quot;the builder&quot;">
<input name="email" value="not-an-email">
<p class="error">Please enter a valid email.</p>

<?php
// File uploads arrive in $_FILES, not $_POST. The form must use
// enctype="multipart/form-data" and method="post" for this to fill.
// Here we fake one entry so the validation logic is runnable.
$_FILES = [
    "avatar" => [
        "name"     => "me.png",        // original filename (DON'T trust it)
        "type"     => "image/png",     // browser-claimed type (DON'T trust it)
        "tmp_name" => "/tmp/php3F2a",  // where PHP stored the upload
        "error"    => 0,               // 0 (UPLOAD_ERR_OK) means success
        "size"     => 48213,           // bytes
    ],
];

$file   = $_FILES["avatar"];
$errors = [];

// 1) Check the upload itself succeeded.
if ($file["error"] !== UPLOAD_ERR_OK) {
    $errors[] = "Upload failed (error code " . $file["error"] . ")";
}

// 2) Enforce a size limit (here 2 MB) — never accept unbounded files.
if ($file["size"] > 2 * 1024 * 1024) {
    $errors[] = "File too large (max 2 MB)";
}

// 3) Whitelist the REAL type. In real code you'd use finfo on tmp_name
//    instead of trusting $file["type"], which the browser can fake.
$allowed = ["image/png", "image/jpeg", "image/webp"];
if (!in_array($file["type"], $allowed, true)) {
    $errors[] = "Only PNG, JPEG or WebP images are allowed";
}

if (empty($errors)) {
    // 4) move_uploaded_file() safely moves it out of the temp folder.
    //    Generate your OWN name — never reuse the user's filename.
    $newName = "uploads/" . bin2hex(random_bytes(8)) . ".png";
    echo "Valid upload — would save to: $newName\n";
    // move_uploaded_file($file["tmp_name"], $newName);  // (real code)
} else {
    foreach ($errors as $e) {
        echo "  - $e\n";
    }
}
?>

Valid upload — would save to: uploads/a1b2c3d4e5f60718.png

<?php
// 🎯 YOUR TURN — sanitize and validate a sign-up field.
// Fill in each blank marked ___ using the 👉 hint, then run it.
$_POST = ["email" => "  ADA@Example.com  "];

// 1) Read the email safely with a fallback, then trim and lowercase it.
$email = strtolower(trim($_POST["email"] ___ ""));   // 👉 the "fallback" operator is  ??

// 2) Validate it. filter_var returns false if it's not a real email.
$valid = filter_var($email, ___) !== false;          // 👉 the email filter is  FILTER_VALIDATE_EMAIL

if ($valid) {
    echo "OK: $email\n";
} else {
    echo "Bad email\n";
}

// ✅ Expected output:
//    OK: ada@example.com
?>

OK: ada@example.com

<?php
// 🎯 YOUR TURN — re-display a comment SAFELY (block the XSS).
// A user submitted HTML. Escape it before echoing it back into the page.
$_POST = ["comment" => "Cool <b>tip</b> <script>alert(1)</script>"];

$comment = trim($_POST["comment"] ?? "");

// 👉 Wrap $comment so < > " ' & become harmless entities.
$safe = ___($comment, ENT_QUOTES, "UTF-8");   // 👉 the function is  htmlspecialchars

echo "<p>$safe</p>\n";

// ✅ Expected output:
//    <p>Cool &lt;b&gt;tip&lt;/b&gt; &lt;script&gt;alert(1)&lt;/script&gt;</p>
?>

<p>Cool &lt;b&gt;tip&lt;/b&gt; &lt;script&gt;alert(1)&lt;/script&gt;</p>

<?php
// CSRF (cross-site request forgery) tricks a logged-in user's browser into
// submitting YOUR form from an attacker's page. The fix: put a secret,
// per-session token in the form and check it on submit. An attacker can't
// guess the token, so forged submissions are rejected.

// --- When you SHOW the form ---
// session_start();  // (real code) loads/creates the user's session
$_SESSION = [];                                       // pretend session store
$_SESSION["csrf"] = bin2hex(random_bytes(32));        // 64-char random secret

$token = $_SESSION["csrf"];
echo "Form would include this hidden field:\n";
echo '  <input type="hidden" name="csrf" value="' . $token . '">' . "\n\n";

// --- When the form is SUBMITTED back ---
$_POST = ["csrf" => $token];                          // the form sent it back

// hash_equals() compares safely (constant time, no timing leaks).
// NEVER use == here.
if (hash_equals($_SESSION["csrf"], $_POST["csrf"] ?? "")) {
    echo "Token matches — request is genuine, process it.\n";
} else {
    echo "Token missing/wrong — reject the request (403).\n";
}
?>

Form would include this hidden field:
  <input type="hidden" name="csrf" value="<64 random hex chars>">

Token matches — request is genuine, process it.