Validation in PHP

PHP

"PHP is a server-side programming language that is flexible, easy to learn, and still the backbone of many websites, even though it is often thought to be outdated"

Hey there, PHP wizard!  Ready to level up your web forms? Today, we're tackling form validation in PHP, making sure user input is clean, safe, and error-free! From checking empty fields to validating emails and passwords, we've got it all covered. Let’s dive in!

Why is Form Validation Important?

Imagine a world where people enter "abcdef" as their email. Chaos, right? Form validation ensures:  Users input the correct data. Protection from security threats (XSS, SQL Injection). A better user experience

Types of Form Validation

Client-side Validation

• Done using JavaScript before sending data to the server.
• Fast, but not secure (users can disable JS!).

Server-side Validation

• Done in PHP (backend) after form submission.
• Secure and reliable, but slightly slower.

Pro tip: Use BOTH for the best experience!

Example: Validating a Registration Form

Let's create a user registration form that checks:  Required fields (name, email, password). Valid email format. Password length (min 6 characters).

HTML Form (register.html)

<form action="register.php" method="post">
    <input type="text" name="name" placeholder="Your Name">
    <input type="email" name="email" placeholder="Your Email">
    <input type="password" name="password" placeholder="Password">
    <button type="submit">Register</button>
</form>

PHP Validation Script (register.php)

if ($_SERVER["REQUEST_METHOD"] == "POST") {
    $errors = [];
    
    // Name validation
    if (empty($_POST['name'])) {
        $errors[] = "Name is required!";
    }
    
    // Email validation
    if (empty($_POST['email'])) {
        $errors[] = "Email is required!";
    } elseif (!filter_var($_POST['email'], FILTER_VALIDATE_EMAIL)) {
        $errors[] = "Invalid email format!";
    }
    
    // Password validation
    if (empty($_POST['password'])) {
        $errors[] = "Password is required!";
    } elseif (strlen($_POST['password']) < 6) {
        $errors[] = "Password must be at least 6 characters!";
    }
    
    // Display errors or success message
    if (!empty($errors)) {
        foreach ($errors as $error) {
            echo "<p style='color: red;'>$error</p>";
        }
    } else {
        echo "<p style='color: green;'>Registration successful!</p>";
    }
}

Example: Validating a Contact Form with Custom Error Messages

We’ll build a contact form where: Name, email, and message are required. Email format is checked. Errors are displayed next to inputs

HTML Form (contact.html)

<form action="contact.php" method="post">
    <input type="text" name="name" placeholder="Your Name">
    <span><?php echo $nameError ?? ''; ?></span>
    <input type="email" name="email" placeholder="Your Email">
    <span><?php echo $emailError ?? ''; ?></span>
    <textarea name="message" placeholder="Your Message"></textarea>
    <span><?php echo $messageError ?? ''; ?></span>
    <button type="submit">Send</button>
</form>

PHP Validation Script (contact.php)

$nameError = $emailError = $messageError = "";

if ($_SERVER["REQUEST_METHOD"] == "POST") {
    if (empty($_POST['name'])) {
        $nameError = "Name is required!";
    }
    if (empty($_POST['email'])) {
        $emailError = "Email is required!";
    } elseif (!filter_var($_POST['email'], FILTER_VALIDATE_EMAIL)) {
        $emailError = "Invalid email format!";
    }
    if (empty($_POST['message'])) {
        $messageError = "Message cannot be empty!";
    }
}

Best Practices for Secure Form Validation

Always validate on the server (client-side validation can be bypassed). Use filter_var() for sanitizing inputs (emails, URLs). Escape output with htmlspecialchars() to prevent XSS. Trim and strip unnecessary characters from input.

You’re now a PHP Form Validation Master!  You learned:  The importance of form validation. How to validate user input in PHP. Best security practices to avoid vulnerabilities.

Keep practicing and make your PHP forms bulletproof! Happy coding!