Q:

HTML Form Directing to PHP File or Include PHP File

Which has higher security?
Including the PHP file on a web page for form use, or directing the user to a PHP file when they press a form button?
Example 1: include 'filename';
Example 2: form action="sendingtheuserhere.php" method="post"
Thank you

A:

Generally, it wouldn't matter whether you include the PHP code that handles form data into the file that contains the form or to have a separate PHP file for the same purpose. 
What would matter is how you handle the form data. Below is an example:
form.php - has the HTML form
<html>
    <head></head>
    <body>
        <form action="send.php" method="post">
            <input name="subject" />
            <textarea name="message"></textarea>
            <button>Send</button>
        </form>
    </body>
</html>

send.php - handles form data
<?php

$user_subject = $_POST['subject'];
$user_message = $_POST['message'];

$send_to = 'myemail@gmail.com';

mail($send_to, $user_subject, $subject_message);

?>

Now with the above code, there are a couple things you should know.

The send.php file has unsafe code. 
Visiting the send.php will send an email to the $send_to address whether someone files the form or not. 

Now if you were to have to separate files, every time you visit the send.php file, an email would be sent. That is whether you fill in the form or you simply visit send.php link. 
Second, if you were to combine the two files, you would have an email sent to you every time someone opens your form. That is because the mail(); function is triggered every time. 
To combat this, you have to make sure the mail function triggers only when the form is submitted. You can do so by changing the code in send.php to the following:
new send.php
<?php

if ($_SERVER["REQUEST_METHOD"] == "POST") { // checks whether a POST request actually exists or not.

    $user_subject = strip_tags(trim($_POST['subject']));
    $user_message = strip_tags(trim($_POST['message']));

    $send_to = 'myemail@gmail.com';

    mail($send_to, $user_subject, $subject_message);

} else {
    echo 'form not filled';
}
?>

Now, in the above code, the first thing we did is to check whether a POST request actually existed. If not, you'll see "Form not filled". After that, to make the request a little more secure to any sort of code injections we used the PHP trim(); and strip_tags(); function.
You can combine the two PHP files like so:
form.php
<?php

if ($_SERVER["REQUEST_METHOD"] == "POST") { // checks whether a POST request actually exists or not.

    $user_subject = strip_tags(trim($_POST['subject']));
    $user_message = strip_tags(trim($_POST['message']));

    $send_to = 'myemail@gmail.com';

    mail($send_to, $user_subject, $subject_message);

}

?>

<html>
    <head></head>
    <body>
        <form action="form.php" method="post">
            <input name="subject" />
            <textarea name="message"></textarea>
            <button>Send</button>
        </form>
    </body>
</html>

