Learn PHP Programming

<?php
// GET: Data appears in URL - use for searches, filters, pagination
// URL: search.php?q=php+tutorials&page=2
$query = filter_input(INPUT_GET, 'q', FILTER_SANITIZE_SPECIAL_CHARS) ?? '';
$page  = filter_input(INPUT_GET, 'page', FILTER_VALIDATE_INT) ?: 1;
echo "Searching for: " . htmlspecialchars($query) . " (page $page)";

// POST: Data in request body - use for creating/modifying data
// Form data not visible in URL, no length limit
if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    $username = filter_input(INPUT_POST, 'username', FILTER_SANITIZE_SPECIAL_CHARS);
    $password = $_POST['password'] ?? '';
    // Process login...
}
?>

<?php
$errors = [];
$success = false;

if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    // Validate name
    $name = trim(filter_input(INPUT_POST, 'name', FILTER_SANITIZE_SPECIAL_CHARS));
    if (empty($name) || strlen($name) < 2) {
        $errors[] = 'Name must be at least 2 characters.';
    }

    // Validate email
    $email = filter_input(INPUT_POST, 'email', FILTER_VALIDATE_EMAIL);
    if ($email === false) {
        $errors[] = 'Please enter a valid email address.';
    }

    // Validate message
    $message = trim(filter_input(INPUT_POST, 'message', FILTER_SANITIZE_SPECIAL_CHARS));
    if (empty($message) || strlen($message) < 10) {
        $errors[] = 'Message must be at least 10 characters.';
    }

    // Process if no errors
    if (empty($errors)) {
        // Save to database or send email
        $success = true;
    }
}
?>
<!-- HTML Form -->
<form method="post" action="">
    <input type="text" name="name" value="<?= htmlspecialchars($name ?? '') ?>" required>
    <input type="email" name="email" value="<?= htmlspecialchars($email ?? '') ?>" required>
    <textarea name="message" required><?= htmlspecialchars($message ?? '') ?></textarea>
    <button type="submit">Send Message</button>
</form>

<?php
// HTML: <form method="post" enctype="multipart/form-data">
//         <input type="file" name="avatar">
if ($_SERVER['REQUEST_METHOD'] === 'POST' && isset($_FILES['avatar'])) {
    $file = $_FILES['avatar'];

    // Check for upload errors
    if ($file['error'] !== UPLOAD_ERR_OK) {
        die('Upload failed with error code: ' . $file['error']);
    }

    // Validate file size (max 2MB)
    if ($file['size'] > 2 * 1024 * 1024) {
        die('File too large. Maximum size is 2MB.');
    }

    // Validate file type by MIME (don't trust extension alone)
    $allowedTypes = ['image/jpeg', 'image/png', 'image/gif'];
    $finfo = finfo_open(FILEINFO_MIME_TYPE);
    $mimeType = finfo_file($finfo, $file['tmp_name']);
    finfo_close($finfo);

    if (!in_array($mimeType, $allowedTypes)) {
        die('Invalid file type. Only JPEG, PNG, and GIF allowed.');
    }

    // Generate safe filename and move
    $ext = pathinfo($file['name'], PATHINFO_EXTENSION);
    $safeName = bin2hex(random_bytes(16)) . '.' . $ext;
    $destination = __DIR__ . '/uploads/' . $safeName;

    if (move_uploaded_file($file['tmp_name'], $destination)) {
        echo "File uploaded as: $safeName";
    }
}
?>

<?php
session_start();

// Generate token on GET request (showing the form)
if ($_SERVER['REQUEST_METHOD'] === 'GET') {
    $_SESSION['csrf_token'] = bin2hex(random_bytes(32));
}

// Verify token on POST request (processing the form)
if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    $token = $_POST['csrf_token'] ?? '';
    if (!hash_equals($_SESSION['csrf_token'] ?? '', $token)) {
        http_response_code(403);
        die('Invalid CSRF token. Please refresh and try again.');
    }
    // Token valid - process form safely
    unset($_SESSION['csrf_token']); // One-time use
}
?>
<!-- Include token in every form -->
<form method="post">
    <input type="hidden" name="csrf_token" value="<?= $_SESSION['csrf_token'] ?>">
    <!-- other fields -->
</form>