What are the pitfalls of relying on $_POST["submit"] to trigger a specific action in PHP?

Relying on $_POST["submit"] to trigger a specific action in PHP can be unreliable because it depends on the value of a form element with the name "submit" being sent in the POST request. This can be easily manipulated or not present at all, leading to unexpected behavior. To solve this, it's better to use a hidden input field with a specific name to determine the action to be taken. 

<form method="post">
    <input type="hidden" name="action" value="specific_action">
    <button type="submit">Submit</button>
</form>

<?php
if ($_SERVER["REQUEST_METHOD"] == "POST") {
    if ($_POST["action"] == "specific_action") {
        // Perform the specific action here
    }
}
?>

Keywords

$_POST submit action trigger pitfalls

Related Questions