Creating Simple Form using PHP and MySql

Written by Saran on July 22, 2013, Updated July 22, 2015

HTML form is an essential part of Web development process, it allows us to gather data from user inputs and we can do various things with the data we receive from user, we can send email, change interface, layout or save the data directly to our MySql table. Today we are going to create a simple HTML form that will collect data from user, such as user name, email and message text, and using PHP we will save the collected data into our MySql database table. This is a common scenario in Web development world where we often need to store various data from users.

Step 1 : Create HTML Form

To create an HTML form just open your HTML editor and put the following code within the <body></body> tag of your HTML page. This will be a plain HTML page, no dynamic server side coding such as PHP is required here. We will talk about PHP in next step.

HTML

<form method="post" action="process.php">
Name : <input type="text" name="user_name" placeholder="Enter Your Name" /><br />
Email : <input type="email" name="user_email" placeholder="Enter Your Email" /><br />
Message : <textarea name="user_text"></textarea><br />
<input type="submit" value="Submit" />
</form>

As you can see in HTML above, I have <form></form> tag, which contains several input field tags like user name and e-mail, and you can always add more input fields if you want to collect more data from user. These input fields can have different attributes, such as name of input field, its type, maxlength, placeholder etc. Even though we only need name and type attributes, we can always play with different attributes as per our project needs.

Attribute	Value	Description
accept	file_extension audio/* video/* image/* media_type	Specifies the types of files that the server accepts (only for type="file")
align	left right top middle bottom	Not supported in HTML5. Specifies the alignment of an image input (only for type="image")
alt	text	Specifies an alternate text for images (only for type="image")
autocomplete	on off	Specifies whether an <input> element should have autocomplete enabled
autofocus	autofocus	Specifies that an <input> element should automatically get focus when the page loads
checked	checked	Specifies that an <input> element should be pre-selected when the page loads (for type="checkbox" or type="radio")
disabled	disabled	Specifies that an <input> element should be disabled
form	form_id	Specifies one or more forms the <input> element belongs to
formaction	URL	Specifies the URL of the file that will process the input control when the form is submitted (for type="submit" and type="image")
formenctype	application/x-www-form-urlencoded multipart/form-data text/plain	Specifies how the form-data should be encoded when submitting it to the server (for type="submit" and type="image")
formmethod	get post	Defines the HTTP method for sending data to the action URL (for type="submit" and type="image")
formnovalidate	formnovalidate	Defines that form elements should not be validated when submitted
formtarget	_blank _self _parent _top framename	Specifies where to display the response that is received after submitting the form (for type="submit" and type="image")
height	pixels	Specifies the height of an <input> element (only for type="image")
list	datalist_id	Refers to a <datalist> element that contains pre-defined options for an <input> element
max	number date	Specifies the maximum value for an <input> element
maxlength	number	Specifies the maximum number of characters allowed in an <input> element
min	number date	Specifies a minimum value for an <input> element
multiple	multiple	Specifies that a user can enter more than one value in an <input> element
name	text	Specifies the name of an <input> element
pattern	regexp	Specifies a regular expression that an <input> element's value is checked against
placeholder	text	Specifies a short hint that describes the expected value of an <input> element
readonly	readonly	Specifies that an input field is read-only
required	required	Specifies that an input field must be filled out before submitting the form
size	number	Specifies the width, in characters, of an <input> element
src	URL	Specifies the URL of the image to use as a submit button (only for type="image")
step	number	Specifies the legal number intervals for an input field
type	button checkbox color date datetime datetime-local email file hidden image month number password radio range reset search submit tel text time url week	Specifies the type <input> element to display
value	text	Specifies the value of an <input> element
width	pixels	Specifies the width of an <input> element (only for type="image")

Step 2: PHP process page

Our HTML form is ready to take inputs from users in above example, we now need to create a PHP page to collect data from this form. PHP is a server-side language, it performs all tasks on the server and end users do not see anything unless there's errors or outputs.Notice action attribute in HTML form tag above? It points to process.php and it means all the values of input fields will be sent to process.php. All we need to do now is create process.php. To simply output captured values through HTML form, we can write something like this :

PHP

<?php
//process.php
if ($_SERVER["REQUEST_METHOD"] == "POST") {//Check it is coming from a form
	$u_name = $_POST["user_name"]; //set PHP variables like this so we can use them anywhere in code below
	$u_email = $_POST["user_email"];
	$u_text = $_POST["user_text"];
	
	//print output text
	print "Hello " . $u_name . "!, we have received your message and email ". $u_email;
	print "We will contact you very soon!";
}
?>

Step 2: PHP Validation

If you have tested above code, you will realize that it is really easy to capture and display values from input fields. But our code is still vulnerable to various unknown attacks. For example, if I put <a href="http://google.com">Sanwebe</a> in name field, it will output a link to Google page. Storing such untrusted data can lead to various code injection exploitations, our website could be easy target of attackers. So we need to clean such inputs before we actually process the data.

PHP

<?php
//process.php
if ($_SERVER["REQUEST_METHOD"] == "POST") {//Check it is comming from a form

	$u_name = filter_var($_POST["user_name"], FILTER_SANITIZE_STRING); //set PHP variables like this so we can use them anywhere in code below
	$u_email = filter_var($_POST["user_email"], FILTER_SANITIZE_EMAIL);
	$u_text = filter_var($_POST["user_text"], FILTER_SANITIZE_STRING);

	if (empty($u_name)){
		die("Please enter your name");
	}
	if (empty($u_email) || !filter_var($u_email, FILTER_VALIDATE_EMAIL)){
		die("Please enter valid email address");
	}
		
	if (empty($u_text)){
		die("Please enter text");
	}	
	
	//print output text
	print "Hello " . $u_name . "!, we have received your message and email ". $u_email;
	print "We will contact you very soon!";
}
?>

I have used PHP filter_vars to clean-out user inputs, and also checked whether posted values are empty. These small measures will insure protection from numerous code injections and make our script attack-proof, so never forget to check invalid data whenever you can.

Step 3: Storing data in MySql

Using PhpMyAdmin interface, you can easily create a new table to store user information. But if you are lazy, you can just drop following MySql code in SQL query box, it will create a new table called "users_data" for you in MySql.

MYSQL

CREATE TABLE IF NOT EXISTS `users_data` (
`id` int(11) NOT NULL,
  `user_name` varchar(60) NOT NULL,
  `user_email` varchar(60) NOT NULL,
  `user_message` text NOT NULL
)AUTO_INCREMENT=1 ;

ALTER TABLE `users_data`
 ADD PRIMARY KEY (`id`);

ALTER TABLE `users_data`
MODIFY `id` int(11) NOT NULL AUTO_INCREMENT;

Once we have the database table, we can continue working on process.php. As you can see in example below, I have added few more PHP code, on top of the code I have provided MySql login info which will be used to connect to MySql database. Once the connection is open, using MySql INSERT query we will store user inputs into database table.

PHP

<?php
if ($_SERVER["REQUEST_METHOD"] == "POST") {//Check it is comming from a form

	//mysql credentials
	$mysql_host = "localhost";
	$mysql_username = "root";
	$mysql_password = "";
	$mysql_database = "test";
	
	$u_name = filter_var($_POST["user_name"], FILTER_SANITIZE_STRING); //set PHP variables like this so we can use them anywhere in code below
	$u_email = filter_var($_POST["user_email"], FILTER_SANITIZE_EMAIL);
	$u_text = filter_var($_POST["user_text"], FILTER_SANITIZE_STRING);

	if (empty($u_name)){
		die("Please enter your name");
	}
	if (empty($u_email) || !filter_var($u_email, FILTER_VALIDATE_EMAIL)){
		die("Please enter valid email address");
	}
		
	if (empty($u_text)){
		die("Please enter text");
	}	

	//Open a new connection to the MySQL server
	//see https://www.sanwebe.com/2013/03/basic-php-mysqli-usage for more info
	$mysqli = new mysqli($mysql_host, $mysql_username, $mysql_password, $mysql_database);
	
	//Output any connection error
	if ($mysqli->connect_error) {
		die('Error : ('. $mysqli->connect_errno .') '. $mysqli->connect_error);
	}	
	
	$statement = $mysqli->prepare("INSERT INTO users_data (user_name, user_email, user_message) VALUES(?, ?, ?)"); //prepare sql insert query
	//bind parameters for markers, where (s = string, i = integer, d = double,  b = blob)
	$statement->bind_param('sss', $u_name, $u_email, $u_text); //bind values and execute insert query
	
	if($statement->execute()){
		print "Hello " . $u_name . "!, your message has been saved!";
	}else{
		print $mysqli->error; //show mysql error if any
	}
}
?>

That's it, process.php is now ready to collect data from HTML form. You can do various things once the data is stored in the table, you can always read MySqli Basic usage article if you are wondering how to retrieve and display saved data. I hope you enjoyed reading this article and it helped you with your projects.

123
24th Nov 2021 at 6:10 pm
thank you so much, this is sooooo helpful Sir
As
21st Dec 2020 at 11:56 pm
Fatal error: Uncaught Error: Call to a member function bind_param() on bool in C:\xampp\htdocs\webdevstudent\php\process.php:36 Stack trace: #0 {main} thrown in C:\xampp\htdocs\webdevstudent\php\process.php on line 36
- Rituraj kumar As
  5th Dec 2022 at 8:02 pm
  bro try to compress your folder name. Always try to small folder names or website names
Ghanish
3rd Apr 2020 at 3:49 pm
This works good
Satta matka
5th Mar 2020 at 1:20 am
Very Good Jobb.. thanks
FXLORD
4th Dec 2019 at 4:13 pm
nice!