Forms

Quick Introduction

Forms is a single PHP idea you'll use in almost every backend project.

In this lesson you learn only forms — not five topics at once. By the end you can write a small working example and explain it in an interview.

We connect each lesson to our course projects: Login System, Blog CMS, REST API, Inventory, Employee Management, and E-Commerce Backend.

Business Problem

You're building the Login System. After a user signs in, you need forms working correctly before storing data or showing a dashboard.

Without understanding Forms, the team ships bugs: wrong totals, broken sessions, or type errors that only appear in production. This lesson fixes that with one clear pattern you can copy into your project today.

Core Concept

• Forms is one focused idea — learn it before mixing with other PHP topics.
• Use it in PHP 8.3+ with declare(strict_types=1); at the top of every file.
• Our course project (Login System) uses forms in real handlers.
• Run small scripts with php file.php after each change — don't just read.
• Interviewers ask for a one-minute explanation plus a tiny code sample.

sequenceDiagram
  Client->>Nginx: HTTP Request
  Nginx->>PHP-FPM: FastCGI
  PHP-FPM->>App: Route Handler
  App->>Session: Read/Write Session
  App-->>Client: HTML / Redirect

Syntax

Core syntax for Forms. Every keyword below appears in production PHP — Laravel and Symfony use the same primitives under the hood.

declare(strict_types=1);

Keywords: declare · strict_types · namespace

Step-by-Step Example

Run this script locally. Change one value, run again, and watch what changes.

<?php
declare(strict_types=1);

session_start(['cookie_httponly' => true, 'cookie_samesite' => 'Strict']);

if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    $token = $_POST['_token'] ?? '';
    if (!hash_equals($_SESSION['csrf'] ?? '', $token)) {
        http_response_code(403);
        exit('Invalid CSRF token');
    }
    $email = filter_input(INPUT_POST, 'email', FILTER_VALIDATE_EMAIL);
    $name  = trim((string)filter_input(INPUT_POST, 'name', FILTER_UNSAFE_RAW));
    echo json_encode(['ok' => true, 'email' => $email, 'name' => htmlspecialchars($name)]);
    exit;
}

$_SESSION['csrf'] = bin2hex(random_bytes(32));
echo '<form method="post"><input name="name"><input name="email"><input type="hidden" name="_token" value="' . $_SESSION['csrf'] . '"><button>Save</button></form>';

Line by line

1. — part of the forms example; run the file to see the result.
2. declare(strict_types=1); — turns on strict type checking for this file.
3. session_start(['cookie_httponly' => true, 'cookie_samesite' => 'Strict']); — part of the forms example; run the file to see the result.
4. if ($_SERVER['REQUEST_METHOD'] === 'POST') { — part of the forms example; run the file to see the result.
5. $token = $_POST['_token'] ?? ''; — part of the forms example; run the file to see the result.

{"status":"ok"}

Real-World Example

In the Login System, forms appears in a single request handler — not spread across ten files. Keep the example small, test it with php, then paste the pattern into your project branch.

<?php
declare(strict_types=1);

// TODO: Forms exercise for Login System