php form validation not working: email sends with empty fields - php

Question

I am having some difficulty in my form not working as expected. Effectively when I click the submit button it will send the email even when I (think) have set up validation to stop it from sending until all of the relevant fields are completed.
<?php
$page_title = "EcoPiggy: PHP Contact Us- Testing";
// define variables and set to empty values
$firstName = $lastName = $email = $telephone = $message = $marketingConsent = $copyEmail = "";
$firstNameErr = $lastNameErr = $emailErr = $telephoneErr = $messageErr = "";
if (isset($_POST['signup'])) {
if (!empty($_POST['tracey'])) {
die;
}
$marketingConsent = ($_POST["marketingConsent"]);
$copyEmail = ($_POST["copyEmail"]);
if (empty($_POST["firstName"])) {
$firstNameErr = "* First Name is required";
} else {
$firstName = test_input($_POST["firstName"]);
if (!preg_match("/^[a-zA-Z0-9 ]*$/", $firstName)) {
$firstNameErr = "* Only letters and white space allowed";
}
$min = 3;
if (strlen($firstName) < $min) {
$firstNameErr = "Validation failed: Too Small minimum 3 characters";
}
$max = 45;
if (strlen($firstName) > $max) {
$firstNameErr = "Validation failed: Too Large maximum 45 characters";
}
}
if (empty($_POST["lastName"])) {
$lastNameErr = "* Last Name is required";
} else {
$lastName = test_input($_POST["lastName"]);
if (!preg_match("/^[a-zA-Z0-9 ]*$/", $lastName)) {
$lastNameErr = "* Only letters and white space allowed";
}
$min = 3;
if (strlen($lastName) < $min) {
$lastNameErr = "Validation failed: Too Small minimum 3 characters";
}
$max = 45;
if (strlen($lastName) > $max) {
$lastNameErr = "Validation failed: Too Large maximum 45 characters";
}
}
if (empty($_POST["email"])) {
$emailErr = "* email address is required";
} else {
$email = test_input($_POST["email"]);
// check if e-mail address is well-formed
if (!filter_var($email, FILTER_VALIDATE_EMAIL)) {
$emailErr = "* Invalid email format";
}
$min = 6;
if (strlen($email) < $min) {
$emailErr = "Validation failed: Too Small minimum 6 characters";
}
$max = 60;
if (strlen($email) > $max) {
$emailErr = "Validation failed: Too Large maximum 60 characters";
}
}
if (empty($_POST["telephone"])) {
$telephoneErr = "* Please enter your telephone number";
} else {
$telephone = test_input($_POST["telephone"]);
if (!preg_match("/^[1-9][0-9]{6-13}*$/", $telephone)) {
$telephoneErr = "* Only numbers and white space allowed";
}
$min = 6;
if (strlen($telephone) < $min) {
$lastNameErr = "Validation failed: Too Small minimum 6 characters";
}
$max = 13;
if (strlen($telephone) > $max) {
$telephoneErr = "Validation failed: Too Large maximum 13 characters";
}
}
if (empty($_POST["message"])) {
$messageErr = "* Your message is required";
} else {
$message = test_input($_POST["message"]);
$min = 3;
if (strlen($message) < $min) {
$messageErr = "Validation failed: Too Small minimum 3 characters";
}
$max = 1000;
if (strlen($message) > $max) {
$messageErr = "Validation failed: Too Large maximum 45 characters";
}
}
if ($marketingConsent == 0) {
$marketingConsent = "Thank you for trusting us to contact periodically with 3rd party promotions";
} else {
$marketingConsent = "I do not want the information to be used by anybody for direct marketing purposes";
}
$create_email = '<ul>';
$create_email .='<li>First Name: ' . $firstName . '</li>';
$create_email .='<li>Last Name: ' . $lastName . '</li>';
$create_email .='<li>Telephone Number: ' . $telephone . '</li>';
$create_email .='<li>Email address: ' . $email . '</li>';
$create_email .='<li>Your message: ' . $message . '</li>';
$create_email .='<li>Marketing consent: ' . $marketingConsent . '</li>';
$create_email .='<li>Cc: ' . $copyEmail . '</li>';
$create_email .= '</ul>';
$header1 = "From: webform#ecopiggy.co.uk \r\n";
$header1 .= "Reply-To: {$email} \r\n";
if ($copyEmail == 1) {
$header1 .= "Cc: {$email}\r\n";
} else {
$header1 .= "";
}
$header1 .= "MIME-Version: 1.0" . "\r\n";
$header1 .= "Content-Type: text/html; charset=ISO-8859-1";
$to = "hello#ecopiggy.co.uk";
$subject = 'Ecopiggy - Contact-Us' . strftime("%T", time());
$message = $create_email;
$headers = $header1;
$result = mail($to, $subject, $message, $headers);
if (isset($result)) {
redirect_to("thankyou.php");
} else {
redirect_to("contact-us.php");
}
}
?>
Can anyone assist in where this validation is going wrong?
Many Thanks,
Asa.

Answer 1

The problem is, even though you're validating your form inputs you're not checking whether any error exists or not before constructing the mail i.e whether $firstNameErr, $lastNameErr etc. are empty or not.
if(empty($firstNameErr) && empty($lastNameErr) && empty($emailErr) && empty($telephoneErr) && empty($messageErr)){
// construct the mail and send it
}else{
// display error messages
}
So your existing code should be like this:
<?php
$page_title = "EcoPiggy: PHP Contact Us- Testing";
// define variables and set to empty values
$firstName = $lastName = $email = $telephone = $message = $marketingConsent = $copyEmail = "";
$firstNameErr = $lastNameErr = $emailErr = $telephoneErr = $messageErr = "";
if (isset($_POST['signup'])) {
if (!empty($_POST['tracey'])) {
die;
}
$marketingConsent = ($_POST["marketingConsent"]);
$copyEmail = ($_POST["copyEmail"]);
if(empty($_POST["firstName"])) {
$firstNameErr = "* First Name is required";
} else {
$firstName = test_input($_POST["firstName"]);
if (!preg_match("/^[a-zA-Z0-9 ]*$/",$firstName)) {
$firstNameErr = "* Only letters and white space allowed";
}
$min=3;
if(strlen($firstName) < $min) {
$firstNameErr = "Validation failed: Too Small minimum 3 characters";
}
$max=45;
if(strlen($firstName) > $max) {
$firstNameErr = "Validation failed: Too Large maximum 45 characters";
}
}
if(empty($_POST["lastName"])) {
$lastNameErr = "* Last Name is required";
} else {
$lastName = test_input($_POST["lastName"]);
if (!preg_match("/^[a-zA-Z0-9 ]*$/",$lastName)) {
$lastNameErr = "* Only letters and white space allowed";
}
$min=3;
if(strlen($lastName) < $min) {
$lastNameErr = "Validation failed: Too Small minimum 3 characters";
}
$max=45;
if(strlen($lastName) > $max) {
$lastNameErr = "Validation failed: Too Large maximum 45 characters";
}
}
if(empty($_POST["email"])) {
$emailErr = "* email address is required";
} else {
$email = test_input($_POST["email"]);
// check if e-mail address is well-formed
if (!filter_var($email, FILTER_VALIDATE_EMAIL)) {
$emailErr = "* Invalid email format";
echo $emailErr;
}
$min=6;
if(strlen($email) < $min) {
$emailErr = "Validation failed: Too Small minimum 6 characters";
}
$max=60;
if(strlen($email) > $max) {
$emailErr = "Validation failed: Too Large maximum 60 characters";
}
}
if(empty($_POST["telephone"])) {
$telephoneErr = "* Please enter your telephone number";
} else {
$telephone = test_input($_POST["telephone"]);
if (!preg_match("/^[1-9][0-9]{6-13}*$/",$telephone)) {
$telephoneErr = "* Only numbers and white space allowed";
}
$min=6;
if(strlen($telephone) < $min) {
$lastNameErr = "Validation failed: Too Small minimum 6 characters";
}
$max=13;
if(strlen($telephone) > $max) {
$telephoneErr = "Validation failed: Too Large maximum 13 characters";
}
}
if(empty($_POST["message"])) {
$messageErr = "* Your message is required";
} else {
$message = test_input($_POST["message"]);
$min=3;
if(strlen($message) < $min) {
$messageErr = "Validation failed: Too Small minimum 3 characters";
}
$max=1000;
if(strlen($message) > $max) {
$messageErr = "Validation failed: Too Large maximum 45 characters";
}
}
if($marketingConsent == 0) {
$marketingConsent = "Thank you for trusting us to contact periodically with 3rd party promotions";
} else {
$marketingConsent = "I do not want the information to be used by anybody for direct marketing purposes";
}
if(empty($firstNameErr) && empty($lastNameErr) && empty($emailErr) && empty($telephoneErr) && empty($messageErr)){
$create_email = '<ul>';
$create_email .='<li>First Name: '.$firstName.'</li>';
$create_email .='<li>Last Name: '.$lastName.'</li>';
$create_email .='<li>Telephone Number: '.$telephone.'</li>';
$create_email .='<li>Email address: '.$email.'</li>';
$create_email .='<li>Your message: '.$message.'</li>';
$create_email .='<li>Marketing consent: '.$marketingConsent.'</li>';
$create_email .='<li>Cc: '.$copyEmail.'</li>';
$create_email .= '</ul>';
echo $create_email;
$header1 = "From: webform#ecopiggy.co.uk \r\n";
$header1 .= "Reply-To: {$email} \r\n";
if ($copyEmail == 1) {
$header1 .= "Cc: {$email}\r\n";
} else {
$header1 .= "";
}
$header1 .= "MIME-Version: 1.0" ."\r\n";
$header1 .= "Content-Type: text/html; charset=ISO-8859-1";
$to = "hello#ecopiggy.co.uk";
$subject = 'Ecopiggy - Contact-Us' .strftime("%T", time());
$message = $create_email;
$headers = $header1;
$result = mail($to, $subject, $message, $headers);
if (isset($result)) {
redirect_to("thankyou.php");
} else {
redirect_to("contact-us.php");
}
}else{
// display errors
}
}
?>

Answer 2

You are doing browser side validation and for that purpose javascript is best. http://www.w3schools.com/js/js_validation.asp this is the link where you can find validation.
and as you mention that you are using HYML5 so just add "required " in your tag so it means this field is mandatory.there are other predefined validation are available in HTML5

Answer 3

Your script clears all of the variables, then checks $_POST variables. However when the check is then passed, you are not setting the new value - unless there is a test_input function you haven't shown above:
$telephone = test_input($_POST["telephone"]);
So at the top of the page you set
$telephone = '';
You then check if
$_POST['telephone'];
is valid, and if it is you set $telephone to a value that has no way of resolving. Then in your email you try to send $telephone, but that value is still null.