10.2 HTTP Request Methods: GET, POST etc. | Web Application Development

Method	Purpose	Data location	Visible in URL?
GET	Retrieve a page or data	Query string: `page.php?id=5&cat=books`	Yes
POST	Send data to create or process something	Request body	No
PUT / PATCH	Replace / partially update a resource (APIs)	Body	No
DELETE	Delete a resource (APIs)	URL	Yes
HEAD / OPTIONS	Headers only / ask what is allowed

GET versus POST: where the form data travels

When to use GET versus POST

GET: safe actions that only read (search, filter, pagination, view product). Can be bookmarked, cached and shared. Never put passwords or private data in a GET URL: it appears in browser history and server logs.
POST: anything that changes data or carries sensitive data (login, register, checkout, upload). Not bookmarked. Can carry much more data than a URL; the server sets the limit (for example PHP's post_max_size, 8 MB by default).

Handling a form in PHP. register.html:

HTML

<form action='register.php' method='post'>
  <input type='text' name='name' required>
  <input type='email' name='email' required>
  <input type='password' name='password' required>
  <button type='submit'>Register</button>
</form>

register.php:

PHP

<?php
if ($_SERVER['REQUEST_METHOD'] !== 'POST') {
    http_response_code(405);
    exit('Method not allowed');
}

$name  = trim($_POST['name'] ?? '');       // ?? gives a default if the key is missing
$email = trim($_POST['email'] ?? '');
$pass  = $_POST['password'] ?? '';

// SERVER-SIDE VALIDATION (never trust the browser)
$errors = [];
if (strlen($name) < 3)                          $errors[] = 'Name too short';
if (!filter_var($email, FILTER_VALIDATE_EMAIL)) $errors[] = 'Invalid email';
if (strlen($pass) < 8)                          $errors[] = 'Password must be 8+ characters';

if ($errors) {
    foreach ($errors as $e) { echo '<p>' . htmlspecialchars($e) . '</p>'; }
    exit;
}

echo 'Welcome, ' . htmlspecialchars($name);

Superglobals (built-in arrays available everywhere)

Variable	Contains
`$_GET`	Values from the URL query string
`$_POST`	Values from a POST body
`$_REQUEST`	GET + POST + cookies (avoid; be explicit)
`$_SERVER`	Server and request info (`REQUEST_METHOD`, `REQUEST_URI`)
`$_COOKIE`	Cookies sent by the browser
`$_SESSION`	Session data stored on the server
`$_FILES`	Uploaded files

File upload sketch:

PHP

if (isset($_FILES['photo']) && $_FILES['photo']['error'] === 0) {
    $allowed = ['image/jpeg', 'image/png'];
    $type = mime_content_type($_FILES['photo']['tmp_name']);
    if (in_array($type, $allowed) && $_FILES['photo']['size'] < 2000000) {
        $ext = pathinfo($_FILES['photo']['name'], PATHINFO_EXTENSION);
        $newName = uniqid('img_') . '.' . $ext;                  // never trust the original name
        move_uploaded_file($_FILES['photo']['tmp_name'], 'uploads/' . $newName);
    }
}

The form needs method='post' enctype='multipart/form-data'.

Redirects: header('Location: success.php'); exit; (call before any output). The Post/Redirect/Get pattern (redirect after a successful POST) stops a refresh from re-submitting the form.

Try it: Build a contact form that validates on the server, displays errors next to the form (re-showing what the user typed), and redirects to a thank-you page on success. Add a search page that uses GET (search.php?q=pen).