 | PHP > GET, POST, SERVER, CLIENT, DATA, ... |  |
Retrieving data in PHP involves accessing GET and POST parameters, as well as server and client information through superglobal variables. It's essential to implement security checks to sanitize and validate user input, preventing common vulnerabilities like XSS and SQL injection. By incorporating these practices, you can develop robust and secure PHP applications.
In PHP, you can retrieve data sent from a form using either the GET or POST methods.
| 1. GET Method | |
GET method sends data via URL parameters, visible to users. It's suitable for non-sensitive data and small amounts of information.
$name = $_GET['name'];
$email = $_GET['email'];
| 2. POST Method | |
POST method sends data in the HTTP request body, not visible in the URL. It's suitable for sensitive data or large amounts of information.
$username = $_POST['username'];
$password = $_POST['password'];
PHP provides superglobal variables to access server and client information.
You can access server information such as request method, host name, and user agent using the $_SERVER superglobal.
$request_method = $_SERVER['REQUEST_METHOD'];
$host = $_SERVER['HTTP_HOST'];
$user_agent = $_SERVER['HTTP_USER_AGENT'];
Client-specific data such as session variables and cookies can be accessed using $_SESSION and $_COOKIE superglobals, respectively.
$_SESSION['user_id'] = 123;
$user_id = $_SESSION['user_id'];
$_COOKIE['username'] = 'john_doe';
$username = $_COOKIE['username'];
| Security Checks | |
When dealing with user input, it's crucial to implement security checks to prevent vulnerabilities like SQL injection and cross-site scripting (XSS).
Use functions like htmlspecialchars() or filter_var() to sanitize user input and prevent XSS attacks.
$clean_input = htmlspecialchars($_POST['input']);
Validate user input to ensure it meets expected criteria using functions like ``filter_var()` with appropriate filters.
$email = $_POST['email'];
if (filter_var($email, FILTER_VALIDATE_EMAIL)) {
// Valid email address
} else {
// Invalid email address
}
3. Avoid SQL Injection
Use prepared statements or parameterized queries to prevent SQL injection attacks when interacting with databases.
$stmt = $pdo->prepare("SELECT * FROM users WHERE username = ?");
$stmt->execute([$username]);
$user = $stmt->fetch();
|
