PHP Form Validation

✅ PHP Form Validation Tutorial

Form validation ensures that the data submitted by users is correct, complete, and secure before processing it. Validation can be done on the client-side (JavaScript) and server-side (PHP). Server-side validation is essential for security, even if client-side validation exists.

1️⃣ Basic PHP Form Validation

HTML Form Example

<form method="post" action="<?php echo htmlspecialchars($_SERVER["PHP_SELF"]);?>">
Name: <input type="text" name="name">
<span style="color:red"><?php echo $nameErr;?></span><br><br>

Email: <input type="text" name="email">
<span style="color:red"><?php echo $emailErr;?></span><br><br>

Website: <input type="text" name="website">
<span style="color:red"><?php echo $websiteErr;?></span><br><br>

Gender:
<input type="radio" name="gender" value="Male"> Male
<input type="radio" name="gender" value="Female"> Female
<span style="color:red"><?php echo $genderErr;?></span><br><br>

<input type="submit" name="submit" value="Submit">
</form>

Name: <input type="text" name="name">

Email: <input type="text" name="email">

Website: <input type="text" name="website">

Gender:

<input type="radio" name="gender" value="Male"> Male

<input type="radio" name="gender" value="Female"> Female

</form>

2️⃣ PHP Validation Script

<?php
$name = $email = $website = $gender = "";
$nameErr = $emailErr = $websiteErr = $genderErr = "";

if ($_SERVER["REQUEST_METHOD"] == "POST") {

// Name Validation
if (empty($_POST["name"])) {
$nameErr = "Name is required";
} else {
$name = test_input($_POST["name"]);
if (!preg_match("/^[a-zA-Z-' ]*$/",$name)) {
$nameErr = "Only letters and spaces allowed";
}
}

// Email Validation
if (empty($_POST["email"])) {
$emailErr = "Email is required";
} else {
$email = test_input($_POST["email"]);
if (!filter_var($email, FILTER_VALIDATE_EMAIL)) {
$emailErr = "Invalid email format";
}
}

// Website Validation (optional)
if (!empty($_POST["website"])) {
$website = test_input($_POST["website"]);
if (!preg_match("/\b(?:https?:\/\/)?[a-z0-9.-]+\.[a-z]{2,}\b/i",$website)) {
$websiteErr = "Invalid URL";
}
}

// Gender Validation
if (empty($_POST["gender"])) {
$genderErr = "Gender is required";
} else {
$gender = test_input($_POST["gender"]);
}
}

// Function to sanitize input
function test_input($data) {
$data = trim($data); // Remove whitespace
$data = stripslashes($data); // Remove backslashes
$data = htmlspecialchars($data); // Convert special chars
return $data;
}
?>

<?php

$name = $email = $website = $gender = "";

$nameErr = $emailErr = $websiteErr = $genderErr = "";

if ($_SERVER["REQUEST_METHOD"] == "POST") {

// Name Validation

if (empty($_POST["name"])) {

$nameErr = "Name is required";

} else {

$name = test_input($_POST["name"]);

if (!preg_match("/^[a-zA-Z-' ]*$/",$name)) {

$nameErr = "Only letters and spaces allowed";

}

// Email Validation

if (empty($_POST["email"])) {

$emailErr = "Email is required";

} else {

$email = test_input($_POST["email"]);

if (!filter_var($email, FILTER_VALIDATE_EMAIL)) {

$emailErr = "Invalid email format";

}

// Website Validation (optional)

if (!empty($_POST["website"])) {

$website = test_input($_POST["website"]);

if (!preg_match("/\b(?:https?:\/\/)?[a-z0-9.-]+\.[a-z]{2,}\b/i",$website)) {

$websiteErr = "Invalid URL";

}

// Gender Validation

if (empty($_POST["gender"])) {

$genderErr = "Gender is required";

} else {

$gender = test_input($_POST["gender"]);

}

// Function to sanitize input

function test_input($data) {

$data = trim($data); // Remove whitespace

$data = stripslashes($data); // Remove backslashes

$data = htmlspecialchars($data); // Convert special chars

return $data;

}

3️⃣ Validation Features Covered

Required Fields: empty() function checks mandatory fields.
Sanitization: trim(), stripslashes(), htmlspecialchars().
Regex Validation: preg_match() checks patterns for name, URL, etc.
Email Validation: filter_var($email, FILTER_VALIDATE_EMAIL).
Error Messages: Display specific error messages next to fields.
Sticky Forms: Keep user input after submission using value="<?php echo $variable;?>".

4️⃣ Example: Display Validated Data

<?php
if ($_SERVER["REQUEST_METHOD"] == "POST" && $nameErr=="" && $emailErr=="" && $genderErr=="") {
echo "<h3>Your Input:</h3>";
echo "Name: $name<br>";
echo "Email: $email<br>";
echo "Website: $website<br>";
echo "Gender: $gender<br>";
}
?>

<?php

if ($_SERVER["REQUEST_METHOD"] == "POST" && $nameErr=="" && $emailErr=="" && $genderErr=="") {

echo "<h3>Your Input:</h3>";

echo "Name: $name<br>";

echo "Email: $email<br>";

echo "Website: $website<br>";

echo "Gender: $gender<br>";

}

5️⃣ Optional Enhancements

Use JavaScript validation for instant feedback.
Limit input lengths with maxlength in HTML.
Use prepared statements for database insertion to prevent SQL Injection.
Validate file uploads: type, size, and extension.

🏁 Summary

Validate server-side to ensure security.
Check required fields, email format, regex patterns, and optional fields.
Sanitize input to prevent XSS attacks.
Show error messages near the input fields.

PHP Form Validation