Form validation using PHP - Stack Overflow
PHP Form Validation
I want to know what I should look for security wise when I validate form input with php.
Depends on what the input is.
Currently I am only using regular expressions to test input, is that enough?
No. Regex only helps you test for textual patterns, and certainly isn't enough if you're doing anything beyond that.
More on reddit.comCreating simple form validation and formatting elements in php?
How can i create a simple validation - just check if field isn't empty and how do i force user to type in numbers only
For simple validation I would rely on javascript/jquery/html to force your parameters
<input type="text" onKeyPress="if(this.value.length==6) return false;" id="number_id_field" required/>
if(this.value.length==6)
This only allows 6 digits in the text box, you can set it to whatever you like
This jquery function checks the key mapping on the key pressed and only allows numbers
//Function to only allow characters 0-9, if any other key is pressed, it will be deleted immediately. Works by
checking the key mapping of keyboard
$('#number_id_field').keyup(function (event) {
if (event.which !== 8 && event.which !== 0 && event.which < 48 || event.which > 57) {
$(this).val(function (index, value) {
return value.replace(/\D/g, "");
});
}
});required/
This makes the form input required so it cant be null
If you want to check that its numeric only using php, you can use a regular expression check
if (!preg_match('/^\d*$/', $number)) {
return json_encode("This is not a number");
}For removing whitespace at the beginning and end of strings, I would look into using ltrtim and rtrim
They are both functions for literally trimming whitespace at the beginning and end of strings respectively
More on reddit.comHow do you validate data?
Videos
I would do something like this:
$req = ['field1', 'field2', 'field...'];
$status = true;
foreach ($req as $field) {
if (empty($_POST[$field])) {
echo 'Field ' . $field . ' is empty';
$status = false;
}
}
if ($status) {
// ok
} else {
// not okay!
}
You create an array ($req), with all field names and loop over them. Check every field against empty() (check the php manual for this function).
Here is a better (and mostly) correct HTML snippet... Please indent properly and read any HTML tutorial for well formed code. Your HTML is **.
<?php
$value=$_POST["valuelist"];
$con = mysql_connect("localhost","root","") or die('Could not connect:'.mysql_error());
mysql_select_db("a&e", $con) or die('Could not select database.');
$fetch_nurse_name = mysql_query("SELECT DISTINCT Fullname FROM nurse");
?>
<html>
<head>
<title>Form Input Data</title>
</head>
<body>
<form method="post" action="insert_ac.php">
<table border="1" bgcolor="lightblue">
<tr>
<td align="left"><strong>Nurse Information</strong></td>
</tr>
<tr>
<td><font color="red">Please select your name</font></td>
</tr>
<tr>
<td>Fullname</td>
<td>
<select name="valuelist">
<option value="valuelist" value="<?php echo $nurse_name; ?>"></option>
<?php
while($throw_nurse_name = mysql_fetch_array($fetch_nurse_name)) {
echo '<option value="'.$throw_nurse_name[0].'">'.$throw_nurse_name[0].'</option>';
}
?>
</select>
</td>
</tr>
<tr>
<td>Please register name here:</td>
</tr>
<tr>
<td>Fullname</td>
<td><input type="text" name="nurse_forename" size="30"> </td>
</tr>
</table>
</form>
</body>
</html>
If you have only the two given fields, this would do it:
$status = false;
$name = '';
if (!empty($_POST['nurse_forename'])) {
$name = $_POST['nurse_forename'];
$status = true;
} elseif (!empty($_POST['valuelist'])) {
$name = $_POST['valuelist'];
$status = true;
} else {
$status = false;
// none of nurse_forname OR valuelist is filled
// abort.
}
Something like
foreach($_POST as $form_entry)
if(empty($form_entry))
echo 'you have to fill in all fields';