PHP Front To Back [Part 11] - Get & Post Tutorial

Key Takeaways

hey guys in this video we're going to be talking about getting post so when you submit a form to a server um to a PHP page you can send data using the get method or the post method and there's a couple differences with both of these so the get method you're actually sending the data through the URL and you don't have to use a form for this you could just add query strings to your URLs and you can send it that way um but doing this is very insecure because you're sending the data right in the URL all right now with the post request it's safer because it's sent in the HTTP header and you can use https to really secure that data and obviously that's what's used with credit card forms and things like that all right so what I'm going to do here is Let's uh let's create a new file in our PHP sandbox and I'm just going to call this get undor post.php all right and what I'm going to do is just add in some HTML Just Tab that over okay and we'll just say my website and then I'm going to paste in a form here just a very simple HTML form you guys I'm sure you guys have dealt with these um we just have a a div here with the label an input with the type of text now this name attribute is very important because that's the that's the attribute that we can hook on to from the server and get this whatever data is submitted so you want to make sure you have the name in this case it's name and then down here we have the name email and then we have a submit button all right now this form in order to um process it we have to add two things okay so we have to add why does it keep doing that that's really strange okay we got to do a method and that's where we Define get or post we're going to start off with get and then an action which is the page that we're going to submit to in this case we're going to submit to uh this file which is getor post.php all right so we're going to submit to this but you could submit to any files sometimes you'll see uh process.php or something like that all right now let's go up here above all the HTML and open up some PHP tags and what we'll do is let's say uh Echo get and let's say we want to get the name okay now if I save this and we load this up I can't talk and type Local Host SL PHP sandbox and what is it uh postore getet or is it get post yeah post.php okay so we get this error because we haven't submitted the form yet so we haven't sent this data so it doesn't know what the hell we're talking about with this index name all right so what we have to do is check to see if that exists so if we say if so if we say if and if we were to just do this like you may think that might work but if we reload we still get the error what we have to do is wrap this in a PHP function called is set which we'll check to see if that value is set so now if we reload we won't get the error okay and when we submit it that will be set and it'll Echo it out so let's go ahead and just put in a name here and submit and you'll see that it'll output that on the screen okay and you can do whatever you want with that data and obviously if you wanted the email you would just go like that and then if we do let's say Brad at gmail.com and we get the email now when we fill out these values we can also do a print R which we've done before in this series and that will basically print out the array so let's just print out get all right so if we submit name and email you'll see that we have an array with the uh index of name and then the value of Brad and then the index of email with the value of Brad gmail.com now when you're working with any kind of user data you have security issues and one of them with with uh PHP is a cross-site scripting attacks or xss attacks and how that works is a hacker will go to your web page that has a form on it and they'll try to insert some uh crazy script to mess things up on your in your in your application so let me just give you an example if we were to just Echo out get email like this actually let's do get name okay and we go over here and let me just clear this out and someone goes and they put in a script tag like that and they put some harmful code in here I'm just going to do an alert one uh but let's say that's some harmful code and they submit it now if we look at our source code with control U look at that we have a script right in our HTML now Chrome actually has some built-in features to prevent this if we hit F12 and actually on this page we hit F12 you'll see right here the xss auditor refused to execute a script okay so we do have some built-in protection but that's not always the case okay okay now to prevent this from working we can use a function called HTML entities and what that does is it takes basically takes the power out of the HTML tags out of the opening and closing uh brackets so let me show you if we were to Echo out HTML entities and wrap that value and let's save that and then we'll go back clear this up out and let's try that again we'll put in our script alert 1 and submit and now you'll see that it just outputs on the screen if we look at the source code it turns the HTML brackets into these entities that are harmless they just printed out on the screen okay so that's a really important function uh when it comes to security and PHP when you're dealing with content that a user can um can submit to the server and what you would probably want to do is create a variable for this such as name equals and then set it to that and then you know Echo out your variable all right so that's get now if you don't want to send data through the and have it be visible in the URL like this then you want to use post instead of get so let's just comment these out here and instead of I'm just going to copy this instead of saying uh if get let's do if post name and we'll go ahead and uncomment that and change that to post and then we'll Echo out name all right now to make a post request we need to go ahead and change this method to post all right so let's save that and let's clear all this crap out of the URL and let's say Brad and submit and we get Brad and notice that there's nothing in the URL that's because the data was sent through the headers not through the URL so this is a much more secure way to send data all right and then you can take it uh take it up a notch and use https and really encrypt that data all right and just like with the get request we can print out the post array as well okay so if we go ahead and reload resubmit the form you'll see that it prints out that array now there is a third way we can get this data and that's by using request so I'm going to copy this and paste that in and I'm going to change this to request and change this and this all right so let's go Echo name and I'm just going to you know what I'll do is uncomment all of this and then I'm just going to comment both of these if statements out okay so let's see what happens if we go ahead and reload okay with the form submitted and we still get this array this is eching out the request variable right here uh and if we want to get rid of that and just Echo out the name we'll get Brad all right now this is going to work whether this value is post or get okay so if we change this to get and reload and submit the form we still get Brad all right let's try and do it this way okay so we get Brad and you'll see that it's up here because it is still we're making a get request but we we're able to retrieve it using this request super Global all right now this isn't used very much you want to stick with getting post uh but this is an alternate way of doing it okay so let me comment that out and then there's one more Super Global value that I want to show you and that is um with server now I know we went over server but we didn't go over this and that's the query string value so let's say query uncore string and let's see what that gives us if we go and submit this form okay it gives us the the entire string gives us the the value here or the I'm sorry the key which is name and then the value and then the or samp and the next value the next key value pair um and so on okay so that's query string excuse me I'm losing my voice um so that's pretty much it oh one more thing I wanted to mention is that we can send along query strings in the URL itself without using a form so for instance uh let's do a list item and let's say we want this to go to this file which is get post.php and then let's add a question mark and we'll say name equals Brad all right and then let's copy this and we'll put another one and we'll change this to Steve okay and let's go up here and I want to uncomment this if statement and let's just comment that out so basically when we click this URL it's going to we're going to be able to fetch that name like we have been and we're going to set the name variable and then down here let's do something like um I'll just use double quotes and we'll say name profile all right so if we reload you'll see if I click on either one of these actually we could wrap this in an H1 make it a little more realistic okay so now we can get Brad and Steve's profile going by the the name value in the URL all right guys so that's going to be it for getting post and we'll be working with these quite a bit uh as we move through this series all right so hopefully you guys are enjoying this series we still got a lot more to come I may be only releasing one every couple days or so because I'm I'm really slammed right now uh for my my courses from edu onics um so try to hang in there and thanks for watching and I'll see you next time