PHP - Form field validation - php

Question

I have a form that takes in data i am using php to send it to my email once a user has filled in all the required fields. If a field is empty I get a message eg. "Email is required" but the email still sends. I dont know what the problem is any ideas? Idont want to send a email if any field is empty i also dont want refresh the page everytime submit is clicked, I would like to instead just show the "Required message".
<?php
function test_input($data) {
$data = trim($data);
$data = stripslashes($data);
$data = htmlspecialchars($data);
return $data;
}
$nameErr = $lastNameErr = $emailErr = $ironingErr = $descriptionErr = $RoomErr = "";
$first_name = $last_name = $email = $ironing = $description = $Rooms ="";
if(isset($_POST['submit'])){
$from = $_POST['email']; // this is the sender's Email address
$first_name = $_POST['first_name'];
$last_name = $_POST['last_name'];
$ironing = $_POST['ironing'];
$Rooms = $_POST['Rooms'];
$Description = $_POST['description'];
if (empty($_POST["first_name"])) {
$nameErr = "Name is required";
} else {
$name = test_input($_POST["first_name"]);
// check if name only contains letters and whitespace
if (!preg_match("/^[a-zA-Z ]*$/",$name)) {
$nameErr = "Only letters and white space allowed";
}
}
if (empty($_POST["email"])) {
$emailErr = "Email is required";
} else {
$email = test_input($_POST["email"]);
// check if e-mail address is well-formed
if (!filter_var($email, FILTER_VALIDATE_EMAIL)) {
$emailErr = "Invalid email format";
}
}
if (empty($_POST["description"])) {
$descriptionErr = "Description is required";
} else {
$description = test_input($_POST["description"]);
}
if (empty($_POST["Rooms"])) {
$RoomErr = "Room number is Required";
} else {
$Rooms = test_input($_POST["Rooms"]);
}
if (empty($_POST["ironing"])) {
$ironingErr = "Ironing is Required";
} else {
$ironing = test_input($_POST["ironing"]);
}
$to = "someemail#gmail.com"; // this is your Email address
$subject = "Order Sumbittion";
$subject2 = "Copy of your form submission";
$message = $first_name . " " . $last_name . " wrote the following:" . "\n\n" . $_POST['description']. "\n\n" . "Number of Rooms: ". "\n\n" . $_POST['Rooms'] ."Ironing: " . $_POST['ironing'];
$message2 = "Here is a copy of your message " . $first_name . "\n\n" . $_POST['description']. "\n\n" . "Number of Rooms: " . "Number of Rooms: " . $_POST['Rooms'] ."Ironing: ". $_POST['ironing'];
$headers = "From:" . $from;
$headers2 = "From:" . $to;
mail($to,$subject,$message,$headers);
mail($from,$subject2,$message2,$headers2);
// sends a copy of the message to the sender
echo "Mail Sent. Thank you " . $first_name . ", we will contact you shortly.";
header("Location: index.php");
}
// You can also use header('Location: thank_you.php'); to redirect to another page.
}
?>
<p><span class="error">* required field.</span></p>
<div class="col-md-9">
<form action="" method="post">
First Name: <input type="text" name="first_name">
<span class="error">* <?php echo $nameErr;?></span><br>
<br>
Last Name: <input type="text" name="last_name">
<span class="error">* <?php echo $lastNameErr;?></span><br>
Email:
<br>
<input type="text" name="email">
<span class="error">* <?php echo $emailErr;?></span>
<br>
Ironing?<br>
<input type="radio" name="ironing" <?php if (isset($ironing) && $ironing=="Yes") echo "checked";?> value="Yes">Yes
<input type="radio" name="ironing" <?php if (isset($ironing) && $ironing=="No") echo "checked";?> value="No">No
<span class="error">* <?php echo $ironingErr;?></span>
<br>
Number Of Rooms:
<br>
<input type="text" name="Rooms">
<span class="error">* <?php echo $RoomErr;?></span>
<br>
Description of the House:
<br>
<textarea name="description" rows="10" cols="70"></textarea>
<span class="error">* <?php echo $descriptionErr;?></span>
<br>
<input type="submit" name="submit" value="Submit">
</form>

Answer 1

Quite simply after checking for errors and loading error message variables, you send the email without checking if any errors have been spotted.
So try adding some code before the email is sent to check for any found errors like this for example
First change this line to set the error variables to NULL
$nameErr = $lastNameErr = $emailErr = $ironingErr = $descriptionErr = $RoomErr = NULL;
And then wrap the email sending in a test like this
if (isset( $nameErr) || isset($lastNameErr) || isset($emailErr) ||
isset($ironingErr) || isset($descriptionErr) || isset($RoomErr) ) {
// You have an error
} else {
$to = "someemail#gmail.com"; // this is your Email address
$subject = "Order Sumbittion";
$subject2 = "Copy of your form submission";
$message = $first_name . " " . $last_name . " wrote the following:" . "\n\n" . $_POST['description']. "\n\n" . "Number of Rooms: ". "\n\n" . $_POST['Rooms'] ."Ironing: " . $_POST['ironing'];
$message2 = "Here is a copy of your message " . $first_name . "\n\n" . $_POST['description']. "\n\n" . "Number of Rooms: " . "Number of Rooms: " . $_POST['Rooms'] ."Ironing: ". $_POST['ironing'];
$headers = "From:" . $from;
$headers2 = "From:" . $to;
mail($to,$subject,$message,$headers);
mail($from,$subject2,$message2,$headers2);
// sends a copy of the message to the sender
echo "Mail Sent. Thank you " . $first_name . ", we will contact you shortly.";
header("Location: index.php");
}

Answer 2

This code works on my own website, the block of code used to email yourself and the user did not actually have an validation to check if any errors came up in your checks.
<?php
function test_input($data) {
$data = trim($data);
$data = stripslashes($data);
$data = htmlspecialchars($data);
return $data;
}
$nameErr = $lastNameErr = $emailErr = $ironingErr = $descriptionErr = $RoomErr = "";
$first_name = $last_name = $email = $ironing = $description = $Rooms ="";
$error = false;
if(isset($_POST['submit']))
{
$from = $_POST['email']; // this is the sender's Email address
$first_name = $_POST['first_name'];
$last_name = $_POST['last_name'];
$ironing = $_POST['ironing'];
$Rooms = $_POST['Rooms'];
$Description = $_POST['description'];
if (empty($_POST["first_name"])) {
$nameErr = "Name is required";
$error = true;
} else {
$name = test_input($_POST["first_name"]);
// check if name only contains letters and whitespace
if (!preg_match("/^[a-zA-Z ]*$/",$name)) {
$nameErr = "Only letters and white space allowed";
$error = true;
}
}
if (empty($_POST["email"])) {
$emailErr = "Email is required";
$error = true;
} else {
$email = test_input($_POST["email"]);
// check if e-mail address is well-formed
if (!filter_var($email, FILTER_VALIDATE_EMAIL)) {
$emailErr = "Invalid email format";
$error = true;
}
}
if (empty($_POST["description"])) {
$descriptionErr = "Description is required";
$error = true;
} else {
$description = test_input($_POST["description"]);
}
if (empty($_POST["Rooms"])) {
$RoomErr = "Room number is Required";
$error = true;
} else {
$Rooms = test_input($_POST["Rooms"]);
}
if (empty($_POST["ironing"])) {
$ironingErr = "Ironing is Required";
$error = true;
} else {
$ironing = test_input($_POST["ironing"]);
}
if ($error === false)
{
$to = "youremail#gmail.com"; // this is your Email address
$subject = "Order Sumbittion";
$subject2 = "Copy of your form submission";
$message = $first_name . " " . $last_name . " wrote the following:" . "\n\n" . $_POST['description']. "\n\n" . "Number of Rooms: ". "\n\n" . $_POST['Rooms'] ."Ironing: " . $_POST['ironing'];
$message2 = "Here is a copy of your message " . $first_name . "\n\n" . $_POST['description']. "\n\n" . "Number of Rooms: " . "Number of Rooms: " . $_POST['Rooms'] ."Ironing: ". $_POST['ironing'];
$headers = "From:" . $from;
$headers2 = "From:" . $to;
mail($to,$subject,$message,$headers);
mail($from,$subject2,$message2,$headers2);
// sends a copy of the message to the sender
echo "Mail Sent. Thank you " . $first_name . ", we will contact you shortly.";
header("Location: index.php");
}
}
// You can also use header('Location: thank_you.php'); to redirect to another page.
?>
<p><span class="error">* required field.</span></p>
<div class="col-md-9">
<form action="" method="post">
First Name: <input type="text" name="first_name">
<span class="error">* <?php echo $nameErr;?></span><br>
<br>
Last Name: <input type="text" name="last_name">
<span class="error">* <?php echo $lastNameErr;?></span><br>
Email:
<br>
<input type="text" name="email">
<span class="error">* <?php echo $emailErr;?></span>
<br>
Ironing?<br>
<input type="radio" name="ironing" <?php if (isset($ironing) && $ironing=="Yes") echo "checked";?> value="Yes">Yes
<input type="radio" name="ironing" <?php if (isset($ironing) && $ironing=="No") echo "checked";?> value="No">No
<span class="error">* <?php echo $ironingErr;?></span>
<br>
Number Of Rooms:
<br>
<input type="text" name="Rooms">
<span class="error">* <?php echo $RoomErr;?></span>
<br>
Description of the House:
<br>
<textarea name="description" rows="10" cols="70"></textarea>
<span class="error">* <?php echo $descriptionErr;?></span>
<br>
<input type="submit" name="submit" value="Submit">
</form>

Answer 3

If you don't want to refresh page, then you can use ajax call to send data on server to validate. Otherwise form will submit and page will refresh every time you slick submit.
And email is being sent every time weather data is valid or not, because there is no condition to check if data is valid. So use a variable and assign it 'false' and before sending check if its still true then send email.
}

Answer 4

First things first , the solution to your issue is that even you caught the error
if (empty($_POST["email"])) {
$emailErr = "Email is required";
}
you did not applied any check to make sure that script execution does not continue , for this you can add die(); also you can take a status variable as $status = 0; if you find any error just assign $status = 1 and before sending email check if($status == 0).
Now if you want to show error message without refreshing the page I would suggest to use jquery or any plugin such as https://validatejs.org/