HTML form: GET and POST, action and name, with a PHP Example
HTML <form> groups input controls into a form submitted to a server. action selects the processing address and method selects the submission method. GET puts values in the URL query and POST puts them in the request body, but POST does not itself encrypt the data.
The roles of action, method, and name
action is the address the browser requests. If omitted, the form submits to the current document address. The default method is get, suitable for searches and retrieval that do not change state. Creation and updates generally use post, with server-side authentication, authorization, and request validation.
A control’s id identifies it in the document and associates its label; name is the submitted data key. Ordinary inputs without name are omitted, as are disabled controls and unchecked radio buttons or checkboxes. Do not nest one form inside another.
Prepare the complete practice form
To check the receiving server as well, opening an HTML file alone is insufficient. Create an empty practice folder in a local environment with PHP 8.x installed, and save both files below in that folder. This example displays received values; it does not store data, send mail, or modify accounts.
The first file is index.html. The second submit button uses formmethod so the same inputs can be compared using GET and POST.
<!doctype html>
<html lang="en">
<head>
<meta charset="utf-8">
<meta name="viewport" content="width=device-width, initial-scale=1">
<title>GET and POST form practice</title>
</head>
<body>
<h1>Compare request methods</h1>
<form action="receive.php" method="get">
<p>
<label for="query">Search term</label>
<input type="text" id="query" name="q" maxlength="80" required>
</p>
<p>
<label for="note">Note</label>
<textarea id="note" name="note" maxlength="300"></textarea>
</p>
<button type="submit">Check with GET</button>
<button type="submit" formmethod="post">Check with POST</button>
<button type="reset">Reset</button>
</form>
</body>
</html>The second file is receive.php. It reads strings from the input collection for the request method and rejects arrays or invalid lengths. Output is escaped for its HTML context.
<?php
declare(strict_types=1);
header('Content-Type: text/html; charset=UTF-8');
$method = $_SERVER['REQUEST_METHOD'];
if ($method !== 'GET' && $method !== 'POST') {
header('Allow: GET, POST');
http_response_code(405);
exit('Unsupported request method.');
}
$input = $method === 'POST' ? $_POST : $_GET;
$q = $input['q'] ?? '';
$note = $input['note'] ?? '';
if (!is_string($q) || !is_string($note) || trim($q) === '' ||
strlen($q) > 320 || strlen($note) > 1200) {
http_response_code(400);
exit('Check the search term and note strings.');
}
function h(string $text): string {
return htmlspecialchars($text, ENT_QUOTES | ENT_SUBSTITUTE, 'UTF-8');
}
?>
<!doctype html>
<html lang="en">
<head>
<meta charset="utf-8">
<meta name="viewport" content="width=device-width, initial-scale=1">
<title>Received result</title>
</head>
<body>
<h1>Received result</h1>
<p>Request method: <?= h($method) ?></p>
<p>Search term: <?= h($q) ?></p>
<p>Note: <?= h($note) ?></p>
<p><a href="index.html">Return to the form</a></p>
</body>
</html>HTML maxlength and the server length check use different measures. This server example limits bytes with strlen; it does not reproduce a complete character-count policy. Validate important inputs according to the server’s actual application rules.
Run the example and compare GET with POST
In the folder containing both files, run this command and open http://127.0.0.1:8000/index.html. If php is not found, check its installation path and PATH setting. PHP’s built-in server is for local development and practice, not production.
php -S 127.0.0.1:8000- Submitting with an empty search term is blocked by required validation.
- Enter HTML as the search term and Practice as the note, then submit with GET. The URL query contains q and note, and the response shows GET as the method.
- Return to the form and enter the same values, then submit with POST. The input values are not appended to the URL, and the response shows POST. Developer tools can show the body in the Network panel.
- Submit
<b>Practice</b>as literal text in the note. The response displays the tag-shaped text rather than bold text. After practice, stop the server with Ctrl+C in the terminal.
Check submission methods, security, and common failures
POST contents remain visible in developer tools and to the server; HTTPS is needed to protect data in transit. GET queries may remain in addresses, history, or logs, so do not put sensitive values such as passwords in them. HTML required and maxlength checks help users but do not replace server validation.
File upload forms generally need method="post" and enctype="multipart/form-data". The default encoding is application/x-www-form-urlencoded. Real file handling also needs size, type, and storage-location checks, beyond this string-input exercise.
For a 404 response, check the relative action path and filename. For missing values, check name and whether the server reads the collection for the correct request method. Explicitly set type="button" for ordinary action buttons to avoid accidental submission. Reset restores original defaults rather than always making fields empty. Consult the MDN form reference and the PHP forms tutorial.
