LuisLlamas Logo
php-formularios-en-php-get-y-post

Forms in PHP: GET and POST

  • 3 min
  • Beginner

GET and POST are HTTP methods that allow sending data from a form to the server.

For a user to send data to your PHP script (a name, a password, a search), we use HTML forms. The key lies in the method attribute of the <form> tag. Depending on which you choose (GET or POST), PHP will receive the data in a different ‘inbox’ (array).

The GET method ($_GET)

When you use method="GET", the data travels publicly in the URL.

  • What does it look like? yourwebsite.com/search.php?product=sneakers&size=42
  • How to retrieve it in PHP? Using the superglobal array $_GET.

Characteristics:

  1. Visible: Everyone sees the data in the address bar.
  2. History: The URL (with the data) is saved in the browser history.
  3. Shareable: You can copy the URL and send it to a friend (ideal for search results).
  4. Limit: It has a character limit (around 2000, depending on the browser).

When to use it? To request information without modifying anything on the server: Search engines, product filters, pagination (page 1, page 2…).

// URL: profile.php?name=Ana&age=25

$name = $_GET['name']; // "Ana"
$age   = $_GET['age'];   // "25"

echo "Hello $name, you are $age years old.";
Copied!

The POST method ($_POST)

When you use method="POST", the data travels hidden within the body of the HTTP request. They are not visible in the URL.

  • What does it look like? yourwebsite.com/login.php (The URL remains clean).
  • How to retrieve it in PHP? Using the superglobal array $_POST.

Characteristics:

  1. Invisible: The data does not appear in the address bar (although a technical user can see it by inspecting the browser’s network traffic).
  2. Greater capacity: The server imposes limits through options like post_max_size; it is not unlimited.
  3. Does not appear in the URL: It is suitable for credentials, but only HTTPS encrypts the request during transport.

When to use it? To send information that will be processed, stored, or will modify something: Registration forms, Login, posting a comment, changing settings.

// HTML: <form method="POST"> <input name="email"> ...

$email = $_POST['email']; 
// The user does not see the email in the URL
Copied!

Comparison between GET and POST

FeatureGETPOST
Superglobal$_GET$_POST
VisibilityVisible in URLHidden in the body
Sensitive dataDo not use for passwordsUse together with HTTPS and validation
Ideal UseSearches, FiltersInserts, Deletions, Updates, Login
BookmarksCan be bookmarkedCannot be bookmarked

Integrated practical example

It is very common to have the form and the PHP code that processes it in the same file. We use a condition to know if it has been submitted.

<?php
// We check if the form was submitted via POST
if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    // We retrieve the data from the input with name="user"
    $user = $_POST['user'];
    echo "<div style='background:green; color:white; padding:10px;'>Received: Hello $user</div>";
}
?>

<form method="POST" action="">
    <label for="name">Your name:</label>
    <input type="text" id="name" name="user" placeholder="Write here...">
    
    <button type="submit">Send my data</button>
</form>
Copied!

In this example we are directly printing what the user writes ($user). If the user enters malicious Javascript code (<script>alert('hack')</script>), our site will execute it. This is a serious vulnerability called XSS.

On this page