PHP sanitize serialized AJAX/JSON data - php

Question

I'm sending form data to a PHP script via AJAX/JSON.
Put this together using online tutorials but it seems to be working fine.
I want to try to edit the PHP script to sanitize the received, serialized AJAX/JSON data before the data is inserted into email.
I've checked around on StackOverflow and more generally on the web but can't find a definitive answer that fits the scripts I'm working with.
The code I'm using is summarized below.
jQuery (abbreviated code)
if (!e.isDefaultPrevented()) {
var url = "contact.php";
$.ajax({
type: "POST",
url: url,
data: $(this).serialize(),
success: function (data)
{
...
}
PHP (abbreviated code)
Data received via AJAX is placed into array:
$fields = array('client_name' => 'Name', 'client_phone' => 'Phone', 'client_email' => 'Email',
'client_message' => 'Message');
Data is then placed into $emailText variable using foreach loop:
foreach ($_POST as $key => $value) {
// If the field exists in the $fields array, include it in the email
if (isset($fields[$key])) {
$emailText .= "$fields[$key]: $value\n\n";
}
}
Data sent in email:
mail($sendTo, $subject, $emailText, $headers);
I'm wondering if there any way the serialized data can be extracted and sanitized in PHP before the email is sent?
Say, with something like:
$sanitizedEmail = filter_var($email, FILTER_SANITIZE_EMAIL);
Any advice much appreciated.

Answer 1

Spent a few hours messing around with this and finally cracked it. Not sure if it is all perfectly written code - but hey, it works.
Probably a routine exercise for someone experienced with jQuery validation and AJAX but quite a mountain to climb for me.
I used the jbvalidator plugin in at:
jbvalidator plugin
... as well as Bootstrap 5.
Here's the finished, working code:
HTML
<form method="post" class="needs-validation" novalidate>
<div class="mb-3">
<input type="text" name="name" class="form-control" placeholder="Your Name" required>
</div>
<div class="mb-3">
<input type="tel" name="phone" class="form-control" placeholder="Your Phone" required>
</div>
<div class="mb-3">
<input type="email" name="email" class="form-control" placeholder="Your Email" required>
</div>
<div class="mb-3">
<textarea rows="4" cols="20" name="message" class="form-control" placeholder="Your Message" required></textarea>
</div>
<input type="submit" name="send" value="Send"><br>
<div class="output_message"></div>
</form>
jQUERY
<script>
$(function (){
let validator = $('form.needs-validation').jbvalidator({
errorMessage: true,
successClass: true,
language:
"https://emretulek.github.io/jbvalidator/dist/lang/en.json"
});
validator.reload();
$(document).on('submit', '.needs-validation', function(){
$.ajax({
method:"post",
url:"process-form.php",
data: $(this).serialize(),
success: function (data){
var alertBox = '<div class="alert alert-success
alert-dismissable fade show" role="alert">Message sent. Thank you.
<button type="button" class="btn-close" data-bs-dismiss="alert" aria-
label="Close"></button></div>';
$('.output_message').html(alertBox);
$('.needs-validation').trigger("reset");
$('.needs-validation input, .needs-validation
textarea').removeClass("is-valid");
if(data.status === 'error') {
var errorBox = '<div class="alert alert-danger
alert-dismissable fade show" role="alert">An error occurred. Please try again
later. <button type="button" class="btn-close" data-bs-dismiss="alert"
aria-label="Close"></button></div>';
$('.output_message').html(errorBox);
$('.needs-validation').trigger("reset");
$('.needs-validation input, .needs-validation
textarea').removeClass("is-valid");
}
}
})
return false;
});
})
</script>
PHP
Code can surely be improved but, like I said, for the moment it's working.
<?php
if (isset($_REQUEST['name'], $_REQUEST['email'])) {
$name = $_REQUEST['name'];
$phone = $_REQUEST['phone'];
$email = $_REQUEST['email'];
$message = $_REQUEST['message'];
$sanitizedName = filter_var($name, FILTER_SANITIZE_STRING);
$sanitizedPhone = filter_var($phone, FILTER_SANITIZE_NUMBER_INT);
$sanitizedEmail = filter_var($email, FILTER_SANITIZE_EMAIL);
$sanitizedMessage = filter_var($message, FILTER_SANITIZE_STRING);
$email_message = "Name: " . $sanitizedName . "\n\n"
. "Phone: " . $sanitizedPhone . "\n\n"
. "Email: " . $sanitizedEmail . "\n\n"
. "Message:\n\n" . $sanitizedMessage;
$to = 'email#someplace.com';
$subject = 'New message';
$headers = 'From: admin#somedomain.com' . "\r\n" .
'Reply-To: ' . $sanitizedEmail . "\r\n" .
'X-Mailer: PHP/' . phpversion();
$send_email = mail($to, $subject, $email_message, $headers);
echo ($send_email) ? 'success' : 'error';
}
?>
Cheers!