- Before You Begin: Accessing PHP
- Creating a Sample Application: Bob's Auto Parts
- Embedding PHP in HTML
- Adding Dynamic Content
- Accessing Form Variables
- Understanding Identifiers
- Examining Variable Types
- Declaring and Using Constants
- Understanding Variable Scope
- Using Operators
- Working Out the Form Totals
- Understanding Precedence and Associativity
- Using Variable Handling Functions
- Making Decisions with Conditionals
- Repeating Actions Through Iteration
- Breaking Out of a Control Structure or Script
- Employing Alternative Control Structure Syntax
- Using declare
- Next
This chapter is from the book
This chapter is from the book
This chapter is from the book
Accessing Form Variables
The whole point of using the order form is to collect customers’ orders. Getting the details of what the customers typed is easy in PHP, but the exact method depends on the version of PHP you are using and a setting in your php.ini file.
Form Variables
Within your PHP script, you can access each form field as a PHP variable whose name relates to the name of the form field. You can recognize variable names in PHP because they all start with a dollar sign ($). (Forgetting the dollar sign is a common programming error.)
Depending on your PHP version and setup, you can access the form data via variables in different ways. In recent versions of PHP, all but one of these ways have been deprecated, so beware if you have used PHP in the past that this has changed.
You may access the contents of the field tireqty in the following way:
$_POST['tireqty']
$_POST is an array containing data submitted via an HTTP POST request—that is, the form method was set to POST. There are three of these arrays that may contain form data: $_POST, $_GET, and $_REQUEST. One of the $_GET or $_POST arrays holds the details of all the form variables. Which array is used depends on whether the method used to submit the form was GET or POST, respectively. In addition, a combination of all data submitted via GET or POST is also available through $_REQUEST.
If the form was submitted via the POST method, the data entered in the tireqty box will be stored in $_POST['tireqty']. If the form was submitted via GET, the data will be in $_GET['tireqty']. In either case, the data will also be available in $_REQUEST['tireqty'].
These arrays are some of the superglobal arrays. We will revisit the superglobals when we discuss variable scope later in this chapter.
Let’s look at an example that creates easier-to-use copies of variables.
To copy the value of one variable into another, you use the assignment operator, which in PHP is an equal sign (=). The following statement creates a new variable named $tireqty and copies the contents of $ POST['tireqty'] into the new variable:
$tireqty = $_POST['tireqty'];
Place the following block of code at the start of the processing script. All other scripts in this book that handle data from a form contain a similar block at the start. Because this code will not produce any output, placing it above or below the <html> and other HTML tags that start your page makes no difference. We generally place such blocks at the start of the script to make them easy to find.
<?php
// create short variable names
$tireqty = $_POST['tireqty'];
$oilqty = $_POST['oilqty'];
$sparkqty = $_POST['sparkqty'];
?>
This code creates three new variables—$tireqty, $oilqty, and $sparkqty—and sets them to contain the data sent via the POST method from the form.
You can output the values of these variables to the browser by doing, for example:
echo $tireqty.' tires<br />';
However, this approach is not recommended.
At this stage, you have not checked the variable contents to make sure sensible data has been entered in each form field. Try entering deliberately wrong data and observe what happens. After you have read the rest of the chapter, you might want to try adding some data validation to this script.
Taking data directly from the user and outputting it to the browser like this is an extremely risky practice from a security perspective. We do not recommend this approach. You should filter input data. We will start to cover input filtering in Chapter 4, “String Manipulation and Regular Expressions,” and discuss security in depth in Chapter 14, “Web Application Security Risks.”
For now, it’s enough to know that you should echo out user data to the browser after passing it through a function called htmlspecialchars(). For example, in this case, we would do the following:
echo htmlspecialchars($tireqty).' tires<br />';
To make the script start doing something visible, add the following lines to the bottom of your PHP script:
echo '<p>Your order is as follows: </p>';
echo htmlspecialchars($tireqty).' tires<br />';
echo htmlspecialchars($oilqty).' bottles of oil<br />';
echo htmlspecialchars($sparkqty).' spark plugs<br />';
If you now load this file in your browser, the script output should resemble what is shown in Figure 1.4. The actual values shown, of course, depend on what you typed into the form.
)
Figure 1.4 The form variables the user typed in are easily accessible in processorder.php
The following sections describe a couple of interesting elements of this example.
String Concatenation
In the sample script, echo prints the value the user typed in each form field, followed by some explanatory text. If you look closely at the echo statements, you can see that the variable name and following text have a period (.) between them, such as this:
echo htmlspecialchars($tireqty).' tires<br />';
This period is the string concatenation operator, which adds strings (pieces of text) together. You will often use it when sending output to the browser with echo. This way, you can avoid writing multiple echo commands.
You can also place simple variables inside a double-quoted string to be echoed. (Arrays are somewhat more complicated, so we look at combining arrays and strings in Chapter 4.) Consider this example:
$tireqty = htmlspecialchars($tireqty);
echo "$tireqty tires<br />";
This is equivalent to the first statement shown in this section. Either format is valid, and which one you use is a matter of personal taste. This process, replacing a variable with its contents within a string, is known as interpolation.
Note that interpolation is a feature of double-quoted strings only. You cannot place variable names inside a single-quoted string in this way. Running the following line of code
echo '$tireqty tires<br />';
simply sends $tireqty tires<br /> to the browser. Within double quotation marks, the variable name is replaced with its value. Within single quotation marks, the variable name or any other text is sent unaltered.
Variables and Literals
The variables and strings concatenated together in each of the echo statements in the sample script are different types of things. Variables are symbols for data. The strings are data themselves. When we use a piece of raw data in a program like this, we call it a literal to distinguish it from a variable. $tireqty is a variable, a symbol that represents the data the customer typed in. On the other hand, ' tires<br />' is a literal. You can take it at face value. Well, almost. Remember the second example in the preceding section? PHP replaced the variable name $tireqty in the string with the value stored in the variable.
Remember the two kinds of strings mentioned already: ones with double quotation marks and ones with single quotation marks. PHP tries to evaluate strings in double quotation marks, resulting in the behavior shown earlier. Single-quoted strings are treated as true literals.
There is also a third way of specifying strings using the heredoc syntax (<<<), which will be familiar to Perl users. Heredoc syntax allows you to specify long strings tidily, by specifying an end marker that will be used to terminate the string. The following example creates a three-line string and echoes it:
echo <<<theEnd
line 1
line 2
line 3
theEnd
The token theEnd is entirely arbitrary. It just needs to be guaranteed not to appear in the text. To close a heredoc string, place a closing token at the start of a line.
Heredoc strings are interpolated, like double-quoted strings.