PHP Forms

How it works

This standalone lab displays a labelled form for GET and processes its days field for POST. Browser constraints improve feedback but can be bypassed, so the server repeats the required type/range checks. The example only reports a value: it deliberately does not update shared data. A real state-changing form also needs authentication where appropriate, CSRF protection and a transactional operation.

Run it locally

Save this standalone lab file in a separate local folder. Start a PHP development server on an unused loopback port, for example php -S 127.0.0.1:8090 -t . . Open the shown filename through that server, not a file URL. Exercise GET and POST as described. This is not a POST endpoint on Bhylu, and the built-in development server is not a production server.

php -l forms.php
php -S 127.0.0.1:8090 -t .

Download this source as a local PHP lab file. Keep lab files separate from the Bhylu project and production data.

Example

<?php
declare(strict_types=1);

$method = $_SERVER["REQUEST_METHOD"] ?? "GET";
if ($method === "GET") {
    header("Content-Type: text/html; charset=utf-8");
    echo '<form method="post"><label for="days">Loan days</label><input id="days" name="days" type="number" min="1" max="30" required><button>Check</button></form>';
    exit;
}
header("Content-Type: text/plain; charset=utf-8");
if ($method !== "POST") { http_response_code(405); header("Allow: GET, POST"); echo "Method not allowed"; exit; }
$raw = $_POST["days"] ?? null;
$days = is_string($raw) ? filter_var($raw, FILTER_VALIDATE_INT, ["options"=>["min_range"=>1,"max_range"=>30]]) : false;
if ($days === false) { http_response_code(422); echo "Enter 1 through 30"; exit; }
echo "Requested: $days days";

Expected result

Form shown on GET; a valid POST returns Requested: 5 days.

The label is connected to the input through matching for/id values. On submission PHP reads its declared name, not its visual label. The same program returns a clear rejection for missing, array-shaped or out-of-range data. The simple response confirms parsing without pretending that an availability check or actual loan has been completed.

Requests to check

• GET forms.php → status 200.
• POST forms.php → status 200; form fields: days.
• POST forms.php → status 422; form fields: days.
• DELETE forms.php → status 405.

Use a local browser form or HTTP client. A CSRF token from one session does not authorise a different session. The automated review uses actual HTTP requests, not just command-line output.