POST Method

With method="post", the browser sends the form values inside the body of the request. They do not show up in the URL.

1
2
3
4
5
6
7
8
9

<form action="signup.php" method="post">
  <label for="email">Email</label>
  <input type="email" id="email" name="email">

  <label for="password">Password</label>
  <input type="password" id="password" name="password">

  <button type="submit">Create account</button>
</form>

PHP reads the values from $_POST.

1
2
3
4

<?php
$_POST = ["email" => "isha@example.com", "password" => "s3cret!"];

echo "Email: " . $_POST["email"];

1

Email: isha@example.com

(We fill $_POST by hand here so the example runs in a terminal. On a real page, PHP fills it from the form.)

Check that the form was submitted

The same file often shows the form and handles it. The request method tells them apart.

1
2
3
4
5
6

<?php
if ($_SERVER["REQUEST_METHOD"] === "POST") {
    // the form was submitted: process it
} else {
    // first visit: just show the form
}

You may see if (isset($_POST["submit"])) in older tutorials. It depends on the button’s name, and it fails when a form is submitted by pressing Enter in some browsers. Checking the request method is more reliable.

When to use POST

Use POST whenever the request changes something or sends private data:

• Login and registration
• Contact forms and comments
• Anything that saves, deletes, buys or sends

POST data is not stored in the URL, browser history or normal server logs. It is also not magic. The visitor can still see and change it, and it is not encrypted unless the site uses HTTPS.

GET vs POST

What happens on refresh

If a visitor refreshes a page that was loaded by POST, the browser asks to resubmit the form. That can send the same message twice. The fix is the Post/Redirect/Get pattern.

POST needs HTTPS

On a live site, always use HTTPS. Without it, POST data travels as plain text.