How to validate my contact form? - php

Question

I used this code to connect my contact form to mysql but the problem is I don't know how to validate each item like the name has to be fill or the email should be valid so it will not bother me later when I take care all of it, here is my code :can you help me :
<?php
$con=mysqli_connect("example.com","peter","abc123","my_db");
// Check connection
if (mysqli_connect_errno())
{
echo "Failed to connect to MySQL: " . mysqli_connect_error();
}
$sql="INSERT INTO Persons (FirstName, LastName, Age)
VALUES
('$_POST[firstname]','$_POST[lastname]','$_POST[age]')";
if (!mysqli_query($con,$sql))
{
die('Error: ' . mysqli_error($con));
}
echo "1 record added";
mysqli_close($con);
?>

Answer 1

You should have client side validation (e.g using jquery)
and in your php you can try like this:
if(!empty($_POST['lastname']) && !empty($_POST['age']) && !empty($_POST['firstname']) && filter_var($_POST['email'], FILTER_VALIDATE_EMAIL)) {
$con=mysqli_connect("example.com","peter","abc123","my_db");
// Check connection
if (mysqli_connect_errno())
{
echo "Failed to connect to MySQL: " . mysqli_connect_error();
}
$sql="INSERT INTO Persons (FirstName, LastName, Age)
VALUES
('mysqli_real_escape_string($con,$_POST[firstname])','mysqli_real_escape_string($con,$_POST[lastname])','mysqli_real_escape_string($con,$_POST[age])')";
if (!mysqli_query($con,$sql))
{
die('Error: ' . mysqli_error($con));
}
echo "1 record added";
mysqli_close($con);
}
You can validate email in php like this:
filter_var($emailAddress, FILTER_VALIDATE_EMAIL)
php filter

Answer 2

For proper validation of a form, some aspects have to be taken into account, to help filter an excess of garbage input. My approach is this:
First of all, check the minimum lenght of the text. This way, you decrease the risk of getting meaningless input. Secondly, check the maximum lenght of the text; you don't want someone flooding your database with a ton of text just for fun. And thirdly, you should use regular expressions to check proper formats for the different fields (a postal code, a phone number, an e-mail) and very important, allow only characters that are required in that field, to avoid or minimize the risk of someone sending miserable cross-site injections thru the input.
Here an orientative example:
function validate_form() {
$errors = array();
// El nombre del usuario es necesario
if (! strlen(trim($_POST['user_name']))) {
$errors[] = 'The username is required.';
}
// El nombre del usuario no debe contener caracteres problemáticos
if (preg_match('#[^a-zA-Z0-9_\- ]#', trim($_POST['user_name']))) {
$errors[] = 'The username cannot contain invalid characters.';
}
// El nombre del usuario no debe tener menos de 3 caracteres
if (strlen(trim($_POST['user_name'])) < 3) {
$errors[] = 'The username cannot have less than 3 characters long.';
}
// El nombre del usuario no debe tener más de 24 caracteres
if (strlen(trim($_POST['user_name'])) > 24) {
$errors[] = 'The username cannot have more than 24 characters long.';
}
// La contraseña es necesaria
if (! strlen(trim($_POST['password']))) {
$errors[] = 'The password is required.';
}
// La contraseña no debe contener caracteres problemáticos
if (preg_match('#[^a-zA-Z0-9_\-]#', trim($_POST['password']))) {
$errors[] = 'The password cannot contain invalid characters.';
}
// La contraseña no debe tener menos de 6 caracteres
if (strlen(trim($_POST['password'])) < 6) {
$errors[] = 'The password cannot have less than 6 characters long.';
}
// La contraseña no debe tener más de 12 caracteres
if (strlen(trim($_POST['password'])) > 12) {
$errors[] = 'The password cannot have more than 12 characters long.';
}
// La contraseña debe contener letras y números
if (! preg_match('/([a-zA-Z][0-9]|[0-9][a-zA-Z])+/', trim($_POST['password']))) {
$errors[] = 'The password must contain letters and numbers.';
}
// Password y Password Check deben ser iguales
if ($_POST['password'] != $_POST['password_check']) {
$errors[] = 'Password and Password Check do not match.';
}
// El correo electrónico es necesario
if (! strlen(trim($_POST['e_mail']))) {
$errors[] = 'The e-mail is required.';
}
// El correo electrónico no debe contener caracteres problemáticos
if (preg_match('/[^a-zA-Z0-9_\-#\.]/', trim($_POST['e_mail']))) {
$errors[] = 'The e-mail cannot contain invalid characters.';
}
// El correo electrónico no debe tener más de 64 caracteres
if (strlen(trim($_POST['e_mail'])) > 64) {
$errors[] = 'The e-mail cannot have more than 64 characters long.';
}
// El correo electrónico debe tener un formato correcto
if (! preg_match('/[^#\s]{3,}#([-a-z0-9]{3,}\.)+[a-z]{2,}/', trim($_POST['e_mail']))) {
$errors[] = 'The e-mail must have a valid format.';
}
// El país seleccionado debe ser válido
if (! array_key_exists($_POST['country'], $GLOBALS['countries'])) {
$errors[] = 'Please select a valid country.';
}
// La ciudad es necesaria
if (! strlen(trim($_POST['city']))) {
$errors[] = 'The city is required.';
}
// La ciudad no debe contener caracteres problemáticos
if (preg_match('#[^a-zA-Z\- ]#', trim($_POST['city']))) {
$errors[] = 'The city cannot contain invalid characters.';
}
// La ciudad no debe tener menos de 3 caracteres
if (strlen(trim($_POST['city'])) < 3) {
$errors[] = 'The city cannot have less than 3 characters long.';
}
// La ciudad no debe tener más de 64 caracteres
if (strlen(trim($_POST['city'])) > 64) {
$errors[] = 'The city cannot have more than 64 characters long.';
}
// El mes seleccionado debe ser válido
if (! array_key_exists($_POST['month'], $GLOBALS['months'])) {
$errors[] = 'Please select a valid month.';
}
// El día seleccionado debe ser válido
if (! array_key_exists($_POST['day'], $GLOBALS['days'])) {
$errors[] = 'Please select a valid day.';
}
// El año seleccionado debe ser válido
if (! array_key_exists($_POST['year'], $GLOBALS['years'])) {
$errors[] = 'Please select a valid year.';
}
// El nombre real del usuario es necesario
if (! strlen(trim($_POST['real_name']))) {
$errors[] = 'Your real name is required.';
}
// El nombre real del usuario no debe contener caracteres problemáticos
if (preg_match('#[^a-zA-Z\- ]#', trim($_POST['real_name']))) {
$errors[] = 'Your real name cannot contain invalid characters.';
}
// El nombre real del usuario debe tener menos de 3 caracteres
if (strlen(trim($_POST['real_name'])) < 3) {
$errors[] = 'Your real name cannot have less than 3 characters long.';
}
// El nombre real del usuario no debe tener más de 64 caracteres
if (strlen(trim($_POST['real_name'])) > 64) {
$errors[] = 'Your real name cannot have more than 64 characters long.';
}
// El número CAPTCHA introducido debe ser correcto
$captcha_num_1 = substr($_POST['captcha'], 0, 1);
$captcha_num_2 = substr($_POST['captcha'], 1, 1);
$captcha_num_3 = substr($_POST['captcha'], 2, 1);
$captcha_num_4 = substr($_POST['captcha'], 3, 1);
$captcha_num_5 = substr($_POST['captcha'], 4, 1);
if (($_SESSION['num1'] != crypt($captcha_num_1, $_SESSION['num1'])) ||
($_SESSION['num2'] != crypt($captcha_num_2, $_SESSION['num2'])) ||
($_SESSION['num3'] != crypt($captcha_num_3, $_SESSION['num3'])) ||
($_SESSION['num4'] != crypt($captcha_num_4, $_SESSION['num4'])) || ($_SESSION['num5'] != crypt($captcha_num_5, $_SESSION['num5']))) {
$errors[] = 'The CAPTCHA number entered is not correct.';
}
// El nombre de usuario y la dirección de e-mail deben ser únicos en la base de datos
global $db;
$sql = 'SELECT user_name, e_mail FROM users';
$q = mysqli_query($db, $sql);
if (mysqli_num_rows($q) > 0) {
while ($users = mysqli_fetch_object($q)) {
if ($users->user_name == $_POST['user_name']) {
$errors[] = 'This username already exists in the database. Please use a different one.';
}
if ($users->e_mail == $_POST['e_mail']) {
$errors[] = 'This e-mail address already exists in the database. Please use a different one.';
}
}
}
// Si hay errores, resetear el CAPTCHA
if (is_array($errors)) { reset_captcha();
}
return $errors;
}

Answer 3

Please find the following answer
<?php
$con=mysqli_connect("example.com","peter","abc123","my_db");
//Check connection
if (mysqli_connect_errno())
{
echo "Failed to connect to MySQL: " . mysqli_connect_error();
}
$c=0;
if($_POST['firstname']=="")
{
$msg='Please enter firstname';
$c++;
}
if($_POST['lastname']=="")
{
$msg1='Please enter lastname';
$c++;
}
if($_POST['age']=="")
{
$msg2='Please enter age';
$c++;
}
if($c==0)
{
$sql="INSERT INTO Persons (FirstName, LastName, Age)
VALUES
('$_POST[firstname]','$_POST[lastname]','$_POST[age]')";
if (!mysqli_query($con,$sql))
{
die('Error: ' . mysqli_error($con));
}
echo "1 record added";
}
mysqli_close($con);
?>
Print $msg,$msg1,$msg2 in respective places