02 Pages and forms: challenges

Set pageTitle before requiring the header.

Use the five-file example from 02.1. Require helpers once, prepare the title, require the header, provide page content and require the footer. Both pages should produce one complete HTML document.

The submitted key comes from name.

Use name="q" on the input and a GET form targeting search.php. The id can remain search if its label uses for="search". The id and submitted key have different responsibilities.

GET values travel in the query string.

The URL includes q=robot. The new request supplies the same query value, and the page generates the result again from its fixed dataset. No server-side session is required for that search.

Check the request method and value shape before using it.

The normal apostrophe displays correctly. Missing, blank or non-string input produces Enter a name rather than a string-function crash. The greeting is a response calculation, not a saved registration.

Test both valid boundaries and just-outside cases.

7 and 13 are accepted. 6 and 14 fail the range; 10.5 fails whole-number validation. HTML browser controls may block some entries, so server-side tests should also send those values directly.

The browser is not the only way to construct a request.

The key is not in the server’s clubs map. Reject it even though the normal select never offers it. An allow-list validates choice; it is separate from authentication or permission.

Escape at each HTML output point.

Use escapeHtml in both paragraph text and quoted value attributes. Inspect response source for escaped characters and confirm no submitted element appears in the DOM. This is not a reason to use the same encoder for SQL or JavaScript.

Initialise a values map; display escaped values independently of success.

The sample stores each received scalar value, collects errors and displays the form again. It must not display a validated preview while errors remain.

The browser sends a session identifier on later requests.

Both pages start the same session using the cookie. favourite.php stores the choice in $_SESSION and the summary reads it. The cookie ordinarily carries the session ID rather than the whole choice array.

Check response status and state separately.

The example returns 403 and skips the state-changing branch. A correct token plus an unknown club still fails the independent allow-list check. CSRF protection is not input validation.

A response sets a cookie for a later request.

After the successful POST redirect, a GET reads compact. An invalid posted mode is not saved. On each later request, incoming cookies are checked against the allow-list; an unexpected cookie falls back to comfortable. Cookies are not trusted permission claims.

Build on the working files rather than copying headers before session setup.

Use the complete examples as the baseline. Add fixed navigation links in the shared header. In each page, load the helper or session bootstrap, process the request, then require the layout header and provide the page-specific HTML. Avoid duplicate document wrappers. Keep preview clearly labelled as unsaved, retain validation and output escaping, and keep the session token on state-changing forms.

Test initial GET, valid and invalid POST, refresh after redirect, a separate browser context and an absent token. Explain one thing not implemented, such as real registration storage or login.