Forms and Files Exercise Solutions | KalviGavani

Chapter 8 — Forms and Files: Exercise Solutions Guide

How to Use This Page

1. Attempt every exercise on your own before reading the solutions. 2. Compare your method with the answer shown — focus on the logic, not just the final output. 3. Practise writing HTML forms and PHP file-handling code by hand; the exam often asks you to write complete programs.

Key Concepts (Quick Recap)

• An HTML form collects user input using elements like <input>, <textarea>, <select>, <radio>, and <checkbox>.
• The <form> tag uses action (URL to send data to) and method (GET or POST) attributes.
• $_GET — collects data sent via URL query string; visible in address bar, limited to ~2048 characters.
• $_POST — collects data sent in HTTP body; invisible in address bar, no size limit, more secure.
• $_REQUEST — contains data from both $_GET, $_POST, and $_COOKIES; convenient but less secure.
• Form validation checks user input before processing — can be client-side (JavaScript) or server-side (PHP).
• File handling in PHP uses functions: fopen(), fwrite(), fread(), fclose(), file_get_contents(), file_put_contents().
• fopen() modes: r (read), w (write, truncate), a (append), r+, w+, a+.
• File upload requires enctype="multipart/form-data" in the form tag and uses the $_FILES superglobal.
• Always validate and sanitize form data on the server side before using it.
• Use htmlspecialchars() to prevent XSS attacks when displaying user input.

I. Choose the Best Answer (MCQs)

Explanation: The $_GET superglobal collects values sent via the URL query string when the form method is GET.

Explanation: Without enctype="multipart/form-data", the browser will not send the file content. The form method must also be POST for file uploads.

Explanation: Mode w opens for writing only; it creates the file if it doesn't exist and erases all existing content (truncates) if it does.

Explanation: fread($handle, $length) reads up to $length bytes from the file pointer. fgets() reads one line.

Explanation: POST sends data in the request body (invisible in URL), has no practical size limit, and is preferred for sensitive data like passwords.

Explanation: When a file is uploaded, PHP stores it in a temporary location. tmp_name gives that temporary path, which you use with move_uploaded_file().

Explanation: fwrite($handle, $string) writes the contents of $string to the file pointed to by $handle.

Explanation: It converts characters like <, >, ", & into <, >, ", & so they render as text rather than being interpreted as HTML.

Explanation: r+ opens for both reading and writing, placing the pointer at the beginning, without truncating. w+ truncates the file; a only appends.

Explanation: move_uploaded_file($tmp_name, $destination) is the secure way to move an uploaded file from its temporary location to a permanent path.

II. Fill in the Blanks

1. The <form> tag uses the action attribute to specify the URL where form data is sent.

2. The method attribute of <form> can be either GET or POST.

3. The superglobal $_POST is used to collect form data sent via the POST method.

4. To read an entire file into a string, use the file_get_contents() function.

5. In fopen("file.txt", "a"), the mode a means append — write data at the end without erasing existing content.

6. The $_FILES superglobal array contains information about uploaded files.

7. fclose() is used to close an open file handle.

8. The function move_uploaded_file() moves an uploaded file from temporary storage to a permanent location.

9. htmlspecialchars() converts special characters to HTML entities to prevent cross-site scripting (XSS).

10. In $_FILES['upload']['name'], the key name stores the original filename from the user's computer.

III. True or False

1. GET method sends form data in the URL query string. — True. Data is appended to the URL as key=value pairs separated by &.

2. POST method has a practical size limit of 2048 characters. — False. POST has no fixed size limit; the 2048-character limit applies to GET (URL length).

3. fopen() returns a file handle resource on success and FALSE on failure. — True.

4. The w mode in fopen() preserves existing file content. — False. The w mode truncates (erases) existing content. Use a mode to preserve content.

5. $_REQUEST contains data from GET, POST, and COOKIES. — True. It is a combined superglobal but is less secure and not recommended for production code.

6. A file upload form must use method="GET". — False. File uploads must use method="POST" along with enctype="multipart/form-data".

7. fgets() reads a single line from a file. — True. It reads until a newline or EOF.

8. fwrite() can only write to newly created files. — False. It can write to any file opened in a writable mode (w, w+, a, a+, r+).

9. It is good practice to always close a file with fclose() after operations. — True. Closing releases the file handle and ensures data is flushed to disk.

10. The a+ mode allows both reading and appending. — True. a+ opens for reading and writing, with the pointer at the end for writing.

IV. Match the Following

Set A

Set B

V. Short Answer Questions

<form action="process.php" method="POST">
    <label>Name:</label>
    <input type="text" name="name" required><br>
    <label>Age:</label>
    <input type="number" name="age" required><br>
    <input type="submit" value="Submit">
</form>

<?php
$filename = "notes.txt";
if (file_exists($filename)) {
    $content = file_get_contents($filename);
    echo nl2br($content);
} else {
    echo "File not found.";
}
?>

<?php
$name = $_FILES['upload']['name'];
$tmp  = $_FILES['upload']['tmp_name'];
move_uploaded_file($tmp, "uploads/" . $name);
echo "File uploaded successfully!";
?>

<?php
$name = trim($_POST['name']);
if (empty($name)) {
    echo "Name is required!";
} elseif (!preg_match("/^[a-zA-Z ]+$/", $name)) {
    echo "Name must contain only letters and spaces.";
}
?>

VI. Detailed Answer Questions

<!DOCTYPE html>
<html>
<body>
<form action="process.php" method="POST">
    <label>Name:</label>
    <input type="text" name="username" required><br>
    <label>Email:</label>
    <input type="email" name="email" required><br>
    <label>Gender:</label>
    <input type="radio" name="gender" value="Male"> Male
    <input type="radio" name="gender" value="Female"> Female<br>
    <input type="submit" value="Register">
</form>
</body>
</html>

<?php
// Sanitize and retrieve data
$name    = htmlspecialchars(trim($_POST['username']));
$email   = filter_var(trim($_POST['email']), FILTER_VALIDATE_EMAIL);
$gender  = $_POST['gender'];

// Validate
if (empty($name)) {
    die("Name is required.");
}
if (!$email) {
    die("Invalid email address.");
}

// Process (display)
echo "<h2>Registration Successful</h2>";
echo "Name: $name<br>";
echo "Email: $email<br>";
echo "Gender: $gender<br>";
?>

$handle = fopen("data.txt", "w") or die("Cannot open file!");

fwrite($handle, "Hello, World!\n");
fwrite($handle, "PHP File Handling\n");

fclose($handle);

$handle = fopen("data.txt", "r") or die("Cannot open file!");
while (!feof($handle)) {
    $line = fgets($handle);
    echo $line . "<br>";
}
fclose($handle);

$handle = fopen("data.txt", "a") or die("Cannot open file!");
fwrite($handle, "New line appended\n");
fclose($handle);

// Read entire file
$content = file_get_contents("data.txt");

// Write entire file
file_put_contents("data.txt", "Overwrites everything");

<!DOCTYPE html>
<html>
<body>
<form action="upload.php" method="POST" enctype="multipart/form-data">
    <label>Select file:</label>
    <input type="file" name="myfile" required><br>
    <input type="submit" value="Upload">
</form>
</body>
</html>

<?php
$targetDir  = "uploads/";
$targetFile = $targetDir . basename($_FILES["myfile"]["name"]);
$fileType   = strtolower(pathinfo($targetFile, PATHINFO_EXTENSION));

// Check if file already exists
if (file_exists($targetFile)) {
    die("Sorry, file already exists.");
}

// Limit file size (2MB max)
if ($_FILES["myfile"]["size"] > 2000000) {
    die("Sorry, file is too large (max 2MB).");
}

// Allow only certain formats
$allowed = array("jpg", "png", "gif", "pdf", "txt");
if (!in_array($fileType, $allowed)) {
    die("Sorry, only JPG, PNG, GIF, PDF, and TXT files are allowed.");
}

// Upload file
if (move_uploaded_file($_FILES["myfile"]["tmp_name"], $targetFile)) {
    echo "The file " . htmlspecialchars(basename($_FILES["myfile"]["name"])) 
         . " has been uploaded.";
} else {
    echo "Sorry, there was an error uploading your file.";
}
?>

<!-- URL: process.php?city=Chennai&state=TN -->
<?php
$city  = $_GET['city'];    // Chennai
$state = $_GET['state'];   // TN
echo "City: $city, State: $state";
?>

<form action="process.php" method="POST">
    <input type="password" name="pwd">
    <input type="submit">
</form>
<?php
$pwd = $_POST['pwd'];  // Data not visible in URL
?>

<?php
// Works for both GET and POST
$city = $_REQUEST['city'];
?>

Common Mistakes

1. Forgetting enctype="multipart/form-data" for file uploads — the file will not be sent; $_FILES will be empty.

2. Not validating/sanitizing form data — raw user input can contain XSS or SQL injection attacks. Always use htmlspecialchars() and filter_var().

3. Confusing fopen() modes w and a — w truncates the file (erases content); a appends without erasing.

4. Not closing files with fclose() — leaves file handles open, may cause data loss or lock issues.

5. Using $_GET for sensitive data — passwords and personal data should always use $_POST.

6. Not checking if a file exists before reading — always use file_exists() before fopen() to avoid errors.

7. Trusting the $_FILES['name'] for saving — always sanitize the filename; a malicious user can set a dangerous name. Use basename() to strip path components.

Exam Checklist

• [ ] Can write a complete HTML form with action, method, and input elements
• [ ] Can differentiate GET vs POST (visibility, security, size, use cases)
• [ ] Know the $_GET, $_POST, $_REQUEST, and $_FILES superglobals
• [ ] Can write PHP code to retrieve and display form data
• [ ] Can perform server-side validation (empty check, regex, filter_var)
• [ ] Can use htmlspecialchars() to prevent XSS
• [ ] Know all fopen() modes (r, w, a, r+, w+, a+) and their behavior
• [ ] Can write PHP programs for file create, read, write, append, and close
• [ ] Can implement a file upload with validation (size, type, existence check)
• [ ] Can explain the complete flow: HTML form → PHP processing → output/display