PHP Form Validation

Intermediate~30 min read

Form validation ensures data is correct, complete, and safe before processing. Never trust user input - always validate and sanitize!

<?php
// Form Validation

// Validate required fields
function validateRequired($value)
{
    return !empty(trim($value));
}

// Validate email
function validateEmail($email)
{
    return filter_var($email, FILTER_VALIDATE_EMAIL) !== false;
}

// Validate length
function validateLength($value, $min, $max)
{
    $length = strlen($value);
    return $length >= $min && $length <= $max;
}

// Example validation
if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    $errors = [];

// Validate name
    if (!validateRequired($_POST['name'] ?? '')) {
        $errors[] = "Name is required";
    }

// Validate email
    $email = $_POST['email'] ?? '';
    if (!validateRequired($email)) {
        $errors[] = "Email is required";
    } elseif (!validateEmail($email)) {
        $errors[] = "Invalid email format";
    }

// Validate password
    $password = $_POST['password'] ?? '';
    if (!validateLength($password, 8, 50)) {
        $errors[] = "Password must be 8-50 characters";
    }

if (empty($errors)) {
        echo "Form is valid!\n";
    } else {
        foreach ($errors as $error) {
            echo "Error: $error\n";
        }
    }
}

Output

Click Run to execute your code

Common Validations

Validation	Function
Required field	`!empty(trim($value))`
Email	`filter_var($email, FILTER_VALIDATE_EMAIL)`
Length	`strlen($value) >= $min && <= $max`
Numeric	`is_numeric($value)`
URL	`filter_var($url, FILTER_VALIDATE_URL)`

Validate Email

<?php
function validateEmail($email) {
    return filter_var($email, FILTER_VALIDATE_EMAIL) !== false;
}

if (validateEmail("[email protected]")) {
    echo "Valid email";
}
?>

Sanitize Input

<?php
// Prevent XSS attacks
$name = htmlspecialchars($_POST['name']);

// Remove HTML tags
$text = strip_tags($_POST['text']);

// Sanitize email
$email = filter_var($_POST['email'], FILTER_SANITIZE_EMAIL);
?>

Summary

Always validate: Never trust user input
filter_var(): Built-in validation
htmlspecialchars(): Prevent XSS
Collect errors: Show all issues at once

What's Next?

Next, learn about Sessions - maintaining user state across pages!

Previous GET & POST

Next Sessions

Common Validations

Validate Email

Sanitize Input

Summary

What's Next?

Enjoying these tutorials?