PHP get checkbox value's separated by comma's - php

Question

I have a contact form with a couple of checkboxes.
Whenever i submit the form I would like the selected value's to be printed separated by comma's.
<form method="POST">
<input type="checkbox" id="product1" name="product1" value="12">
<input type="checkbox" id="product2" name="product1" value="13">
<input type="checkbox" id="product3" name="product1" value="14">
<button type="submit">Subscribe</button>
</form>
I'm using this form. Lets say product 1 and 2 are selected. Then it should print 12,13 <
What is the best way to do this? Is it even possible?
Thanks in advance.
USE CASE:
So I thought it was useful to post why I need this.
Later when I'm able to get the values I will do something like this:
header("Location: http://test.com/$myvalues");
So this link can be test.com/12,13 after the user submits the form.
Not working:
So im using this code
<?php
if(isset($_POST['product'])){
$values = implode(',',$_POST['product']);
// header("Location: https://test.com/?add-to-cart=$values");
}
?>
Whenever i click on the submit button, it takes me to a page that doesnt exist. So i get a 404 page. Even with the header location commented off.
The header location doesnt seem to work at all.

Answer 1

<form method="POST" action="upload.php" >
<input type="checkbox" id="product1" name="product[]" value="12">
<input type="checkbox" id="product2" name="product[]" value="13">
<input type="checkbox" id="product3" name="product[]" value="14">
<button type="submit" name="products" >Subscribe</button>
</form>
in upload.php
$a=$_POST['product'];
$prodt=implode(',',$a);
$prodt has the value

Answer 2

To consolidate Alive to Die's answer and the comments about XSS by hanshenrik;
Use the array-like syntax in the input name attribute:
<form method="POST">
<input type="checkbox" id="product1" name="product[]" value="12">
<input type="checkbox" id="product2" name="product[]" value="13">
<input type="checkbox" id="product3" name="product[]" value="14">
<button type="submit">Subscribe</button>
</form>
If you check the first two checkboxes and submit, you should receive:
$POST['product'] == ["12", "13"];
Of course any input needs to be validated and escaped before outputting in the response. For the specific use-case you mention, you would end up with something like this:
$products = [];
if (isset($POST['product'])) {
foreach ($POST['product'] as $product) {
if (!is_numeric($product)) {
die("invalid product value.");
}
$products[] = intval($product);
}
}
if (empty($products)) {
die("no products selected.");
}
header("Location: https://test.com/" . implode(",", $products);
Clarification on input validation:
If you skip the input validation, one could submit the following data:
product[]="admin.php" and get redirected to https://test.com/admin.php. Of course that wasn't what you wanted this script to do, so by that principle alone you should consider restricting the possible behavior of your code. But it could get worse:
If you choose to echo implode(",", $POST['product']) somewhere in your website, someone might submit:
product[]="<script>alert(\"vuln\");</script>" which will add JavaScript to your website. An alert isn't dangerous, but this script could be anything. From submitting your session cookies to running a cryptominer in your browser. In principle, if you can alert(), you can do anything.
If you construct your original form from a database, someone might insert malicious inputs as values into the database. So these attacks are not necessarily limited to a single user playing around with their element inspector.
These are a lot of 'ifs' and for a simple local website or PHP script, you don't need to concern yourself with most of these issues. However, if you choose to make any of your code available to the internet, you should never trust user input.

Answer 3

Since you've given every checkbox the same name attribute, you can't. Give them separate names and you can easily handle this client and/or server side.