PHP Front To Back

PHP Front To Back [Part 11] – Get & Post Tutorial

hey guys in this video we're going to be talking about getting post so when you submit a form to a server to a PHP page you can send data using the get method

or the post method and there's a couple differences with both of these so the get method you're actually sending the data through the URL and you don't have to use a form for this you could just

add query strings to your URLs and you can send it that way but doing this is very insecure because you're sending the data right in the URL all right now with a post request it's

safer because it's sent in the HTTP header and you can use HTTPS to really secure that data and obviously that's what's used with credit cards forms and things like that all right so what I'm

going to do here is let's uh let's create a new file in our PHP sandbox and I'm just going to call this get underscore post dot PHP alright and what I'm going to do is just add in some HTML

have that over okay and we'll just say my website and then I'm going to paste in a form here just a very simple HTML form you guys I'm sure you guys have dealt with these we just have a div here

with a label and input with the type of text now this name attribute is very important because that's the that's the attribute that we can hook on to from the server and get this whatever data is

submitted so you want to make sure you have the name in this case its name and then down here we have the name email and then we have a submit button alright now this

form in order to process it we have to add two things okay so we have to add one if you keep doing that that's really strange I'm going to do a method and that's where we define get or post or

it's not off of to get and then in action which is the page that we're going to submit to in this case we're going to submit to this file which is get

underscore post dot PHP all right so we're going to submit to this but you could submit to any files and sometimes you'll see process dot PHP or something like that

all right now let's go up here above all the HTML and open up some PHP tags and what we'll do is let's say echo get and let's say we want to get the name ok now if I save this and we load this up I

can't talk and type localhost / PHP sandbox and with post underscore get our they get close here close dot PHP okay so we get this error because we haven't submitted the form yet so we haven't

sent this data so it doesn't know what the hell we're talking about with this index name all right so what we have to do is check to see if that exists so if we say if so if we say if and if we were

to just do this like you may think that might work but if we reload we still get the error what we have to do is wrap this in a PHP function called is set which will check to see if that value is

set so now if we reload we won't get the error okay and when we submit it that will be set and it will echo it out so let's go ahead and just put in a name here and submit and you'll see that

it'll output that on the screen okay and you can do whatever you want with that data and obviously if you wanted to email you would just go like that and then if we do is they brad at gmail.com

and we get the email now we fill out these values we can also do a print R which we've done before in this series and that will basically print out the array

so let's just print out get alright so if we stood that name and email you'll see that we have an array with the index of name and then the value of Brad and then the index of email with the value

of Brad at gmail.com now when you're working with any kind of user data you have security issues and one of them with with PHP is a cross-site scripting attacks or XSS attacks and how that

works is a hacker will go to your web page that has a form on it and they'll try to insert some crazy script to mess things up on your in your in your application so let me just give you an

example if we were to just echo out get email like this actually let's do get name okay and we go over here and let me just clear this out and someone goes and they put in a script tag like that and

they put some harmful code in here I'm just going to do an alert one but let's say that's some harmful code and they submit it now if we look at our source code with control you look at that we

have a script right in our HTML now Chrome actually has some built-in features to prevent this if we hit f12 and actually on this page we hit f12 you'll see right here the XSS auditor

refused to execute a script okay so we do have some built-in protection but that's not always the case okay now to prevent this from working we can use a function called HTML entities and what

that does is it takes basically takes the power out of the HTML tags of the opening and closing brackets so let me show you if we were to echo out HTML entities and wrap that value

and save that and then we'll go back clear this out and try that again we'll put in our script alert 1 and submit and now you'll see that it just outputs on the screen if we look at the

source code it turns the HTML brackets into these entities that are harmless they just print it out on the screen okay so that's a really important function when

it comes to security in PHP when you're dealing with content that a user can can submit to the server and what you would probably want to do is create a variable for this such as name equals and then

set it to that and then you know echo out your variable all right so that's get now if you don't want to send data through the in habit be visible in the URL like this then you want to use post

instead of get so let's just comment these out here and instead of I'm just going to copy this instead of saying it's get let's do this post name and we'll go ahead and uncomment that and

change that to post and then we'll echo out name all right now to make a post request we need to go ahead and change this method to post all right so let's save that and clear all this crap out of

the URL and Brad and submit and we get Brad notice that there's nothing in the URL that's because the data was sent through the headers not through the URL so this is a much more secure way to

send data all right and then you can take it take it up a notch and use HTTP and really encrypt that data all right and just like with the get request we can print out the post array as well

okay so if we go ahead and reload resubmit the form you'll see that it prints out that'll right now there is a third way we can get this data and that's by using request so I'm going to

copy this and paste that in and we'll change this to request and change this and this all right so let's go echo name and just going to you know what I'll do is I'm calling all this and then I'm

just going to comment both of these if statement though okay so let's see what happens if we go ahead and reload okay with the form submitted and we still get this array this is echoing out the

request variable right here and if we want to get rid of that and just echo out the name we'll get Brad all right now this is going to work whether this value is post or get okay so if we

change this to get and reload and submit the form we still get Brad all right let's try and do it this way okay so we get Brad and you'll see that it's up here because it is still we're making a

get request but we'll rate we're able to retrieve it using this request superglobal all right now this isn't used very much you want to stick with to get in post but this is an alternate way

of doing it okay so let me comment that out and then there's one more super global value that I want to show you and that is with the server I know we went over server but we

didn't go over this and that's the query string value let's say query underscore strength and let's see what that gives us if we go and submit this form okay it gives us the the entire string gives us

the value here nits are they I'm sorry the key which is name and then the value and then the ampersand and the next value the next key value pair and so on okay so that's query string excuse me I

lose my voice so that's pretty much it oh one more thing I want to mention is that we can send along query strings in the URL itself without using a form so for instance let's do a list item and

let's say we want this to go to this file which is get post dot PHP and then let's add a question mark and we'll say name equals Brad all right and then let's copy this it'll put another one

and we'll change this to Steve okay and let's go up here and I want to uncomment this if statement and just call me that out so basically when we click this URL is going to we're

going to be able to fetch that name like we have been and we're going to set the name variable and then down here let's do something like I'll just use double quotes it'll say name profile

alright so if we reload you'll see if I click on either one of these actually we can wrap this in an h1 make it a little more realistic okay so now we can get Brad into these profiles going by the

name value in the URL alright guys so that's going to be it for getting post and we'll be working with these quite a bit as we move through this series all right so hopefully you guys are enjoying

this series we've still got a lot more to come I may be only releasing one every couple days or so because I'm really slammed right now for my courses from edge' wanax so try to hang in there

and thanks for watching and I'll see you next time

In this video we will take a look at the $_GET and $_POST superglobals as well as form processing. We will also look at the htmlentities() function for page security

CODE: Code for this video
http://www.traversymedia.com/downloads/phpsandbox/phpsandbox9.zip

EDUONIX COURSES: Pleas use affiliate links from website below
http://www.traversymedia.com/eduonix-courses

SUPPORT: We spend massive amounts of time creating these free videos, please donate to show your support:
http://www.patreon.com/traversymedia
http://www.paypal.me/traversymedia

FOLLOW TRAVERSY MEDIA:
http://www.facebook.com/traversymedia
Posts by traversymedia
http://www.linkedin.com/bradtraversy