You would never create a create-form.php, doing so would introduce a security problem.
For example, lets say your client changed themes, this contact form would still work. Even with the theme deactivated. The same is true of any form handler, AJAX handler, or endpoint for a remote service that directly accesses a PHP file inside a theme or plugin.
WordPress is a CMS, it’s supposed to handle all the requests made to it, not individual files in a plugin or theme
Instead, don’t specify an action on your form, include a hidden input to check against, and then look for that input to handle your form input, e.g.:
// Template
<form method="POST">
<input type="hidden" name="aviras_contact_form" value="contact_form">
....
</form>
// functions.php
add_action( 'init', function() {
if ( empty( $_POST['aviras_contact_form'] ) ) {
return;
}
// handle form submission
}
For AJAX, use register_rest_route ( consider asking a new question on how to do that ). For 3rd party call ins or handlers, use rewrite rules or check for parameters
Also, indent your code, all the major popular editors today all auto-indent for you and have packages to reindent and beautify automatically ( PHPStorm, Netbeans, Sublime Text, Coda, etc etc )