Form Validation
Form validation is the checking of submitted values before a program trusts them. A check reports each problem it finds instead of letting a bad value through.
Problems collected in an array
The checks run on a complete form first and on an empty form second. The complete form prints its all-clear line, and the empty form prints both problem lines from its array.
<?php
$_POST = ["name" => "Hana", "email" => "hana@example.com"];
$problems = [];
if (!isset($_POST["name"]) || empty($_POST["name"])) {
$problems[] = "Name is missing";
}
if (!isset($_POST["email"]) || empty($_POST["email"])) {
$problems[] = "Email is missing";
}
echo "First form\n";
if (count($problems) === 0) {
echo "All fields present\n";
}
$_POST = [];
$problems = [];
if (!isset($_POST["name"]) || empty($_POST["name"])) {
$problems[] = "Name is missing";
}
if (!isset($_POST["email"]) || empty($_POST["email"])) {
$problems[] = "Email is missing";
}
echo "Second form\n";
foreach ($problems as $problem) {
echo $problem . "\n";
}An email check with filter_var
FILTER_VALIDATE_EMAIL names the email rule for filter_var. The valid address comes back as a string, and the broken address comes back as false.
<?php
var_dump(filter_var("hana@example.com", FILTER_VALIDATE_EMAIL));
var_dump(filter_var("hana@", FILTER_VALIDATE_EMAIL));A whole number check
FILTER_VALIDATE_INT names the whole number rule. The text 42 passes and comes back as a number, and the text 4.5 fails and comes back as false.
<?php
var_dump(filter_var("42", FILTER_VALIDATE_INT));
var_dump(filter_var("4.5", FILTER_VALIDATE_INT));Example
<?php
$_POST["name"] = "Hana";
$_POST["email"] = "hana@example.com";
$_POST["age"] = "30";
if (!empty($_POST["name"])) {
echo "Name accepted\n";
} else {
echo "Name rejected\n";
}
if (filter_var($_POST["email"], FILTER_VALIDATE_EMAIL) !== false) {
echo "Email accepted\n";
} else {
echo "Email rejected\n";
}
if (filter_var($_POST["age"], FILTER_VALIDATE_INT) !== false) {
echo "Age accepted\n";
} else {
echo "Age rejected\n";
}Key points
- isset reports whether a field is present in the submitted values.
- empty reports whether a value is missing or holds empty text.
- Collecting problems in an array lets a program print every problem in one pass.
- filter_var checks a value against a rule and hands back the value when the value passes.
- filter_var hands back false when a value fails its rule.
- FILTER_VALIDATE_EMAIL names the rule for an email address shape.
- FILTER_VALIDATE_INT names the rule for a whole number.
In this example, three lines fill $_POST by hand with a name, an email address and an age. The name passes the empty check, the email address passes the email rule and the age passes the whole number rule. Each check prints its accepted line, so the summary holds three verdicts.
Try it Yourself
Edit the code, then press Run.
Running is simulated
Exercise
What does filter_var hand back when a value fails its rule?