How should I validate form input data using PHP? [closed] - php

Question

It's difficult to tell what is being asked here. This question is ambiguous, vague, incomplete, overly broad, or rhetorical and cannot be reasonably answered in its current form. For help clarifying this question so that it can be reopened, visit the help center.
Closed 11 years ago.
Hi im still learning PHP so dont be too harsh if my code seems stupid. Anyways, I'm trying to make a contact page and add validation to it. I'm using an if statement but I don't think it is right, any way how should the below code look?
<?php
if($name_blank == false){
echo"you left name blank";
}
else if($email_blank == false){
echo"Email blank";
}
else if($email_fake == false){
echo"Fake email";
}
else if($number_blank == false){
echo"Number blank";
}
else if($number_low == false){
echo"Number incorrect";
}
else if($number_fake == false){
echo"Fake number";
}
else if($comment_blank == false){
echo"Commant blank";
}else{
hasError = false;
}
?>
thanks.

Answer 1

There are plenty of libraries/frameworks that will take care of most of the work involved in forms (and other annoying bits in PHP) for you. I like Symfony but you might want to find something a bit less complicated if all you want is a contact form.
Both IF/ELSEIF/ELSE and SWITCH/CASE aren't great structures for something like this. In both cases, the code will stop at the first condition that evaluates to true. If someone has more than one invalid input in your form, you will only output an error message for the first issue you find.
I would use something like:
$hasError = false;
if($name_blank == false){
echo"you left name blank";
$hasError = true;
}
if($email_blank == false){
echo"Email blank";
$hasError = true;
}
if($email_fake == false){
echo"Fake email";
$hasError = true;
}
if($number_blank == false){
echo"Number blank";
$hasError = true;
}
if($number_low == false){
echo"Number incorrect";
$hasError = true;
}
if($number_fake == false){
echo"Fake number";
$hasError = true;
}
if($comment_blank == false){
echo"Commant blank";
$hasError = true;
}
Of course, there is a lot more to properly using forms, but to get the basic functionality your looking for, this will do the job.

Answer 2

Considering usage of else if it seems all right.
In PHP, you can write both elseif or 'else if' (in two words) and the behavior would be identical to the one of 'elseif' (in a single word). The syntactic meaning is slightly different but the bottom line is that both would result in exactly the same behavior.

Answer 3

some short stuff:
instead of writing ($a == false), you can always write (!$a)
if name_blank indicates that the name is blank, one would think that an error message is in order if it true, not false, so maybe your variable naming is a bit strange
no reason not to give out all the errors, not only the first one (ie only if (){} if (){} etc.) you might want to add them to an error message string, that will also allow you to find out if hasError or not

Answer 4

Please look into these functions:
empty() - helps to check whether the user submitted data into a field
strip_tags() - prevents XSS*
isset() - check whether a variable is set or not
And when you'll start learning databases:
mysqli_real_escape_string() - prevents SQL injection*
What you did there is not enough, nor correct.
If the name is NOT blank then you skip every other field, because of else if's, but those skipped fields could be empty, too!
So I recommend you understand the execution flow first, in this case having only ifs it would be ok, plus the functions I mentioned above!
* of course there is more you can do, but for now it's enough

Answer 5

Do all the user friendly validation on client side and ignore requests coming with an invalid form data on the server side for security.
Somebody who passes through your client side validation doesn't deserve any user friendliness anyway.
Validation is too expensive in terms of programmer time. Don't spend too much time on validating input.
in this case, use ifs and not else ifs, learn what if and else does.
My personal preference is
switch(true){
case blabla>number: break;
case blabla=="": break;
case strlen(blabla)==5: break;
}