PHP POST

How data reaches $_POST

When a form is submitted with method="post", the browser packs the field values into the request body instead of the URL. PHP reads that body and fills the $_POST array, keyed by each field's name attribute. Because the values travel in the body rather than the address bar, they do not appear in the URL, browser history, or basic server logs.

This makes POST the natural choice for login forms, registration, comments, and anything that writes to a database or sends an email. Reloading a POST result typically prompts the browser to warn about resubmitting the data, which is a hint that the action had a real effect.

A basic POST form

The name attribute on each input becomes the key inside $_POST. Below, a form collects a username and PHP reads it back after submission.

<form method="post" action="welcome.php">
  <label>Username: <input type="text" name="username"></label>
  <button type="submit">Sign in</button>
</form>

<?php
// welcome.php
if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    $username = trim($_POST['username'] ?? '');
    echo "Welcome, " . htmlspecialchars($username) . "!";
}
?>

Handling several fields at once

Real forms usually send many fields. Read each one defensively, trimming whitespace and supplying a default so a missing field does not raise a warning.

<?php
if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    $name    = trim($_POST['name'] ?? '');
    $email   = trim($_POST['email'] ?? '');
    $message = trim($_POST['message'] ?? '');

    if ($name === '' || $email === '') {
        echo "Name and email are required.";
    } else {
        echo "Thanks, " . htmlspecialchars($name) . ". We'll reply to "
           . htmlspecialchars($email) . ".";
    }
}
?>

When to choose POST

• The request changes state, such as saving a record or sending a message
• The data should not appear in the URL or be bookmarkable
• You are handling passwords, tokens, or other sensitive fields
• The payload is large, for example a long text area or a file upload