how to validate input data in php page

[Maideen]

Hi.
I am new. I don't know how to validate certain data like emai, web site and numeric value. Here is my code which is work fine. Below is my code.

Pls Help me

add.php

<?php

include_once '../inc/header.php';
?>
<Script Language="javascript">
function change_action()
    {
        var frm_obj=document.getElementById("frm");
        frm_obj.action="data.php";
    }
</Script>


<form action="" method="POST" id="frm" >
    <table class=""  align="center" cellpadding="4" cellspacing="1">  
    <tr>
        <td><label class="lbl">ID </label></td>
        <td><label class="lbl">: </label></td>
        <td><input type="text" name="id" id="id" readonly="" class="txt"></td>
    </tr>    
    <tr>
        <td><label class="lbl">Name </label></td>
        <td><label class="lbl">: </label></td>
        <td><input type="text" name="name" id="name" class="txt"></td>
    </tr>
    <tr>
        <td><label class="lbl">Address </label></td>
        <td><label class="lbl">: </label></td>
        <td><textarea  name="address" id="address" class="txt" rows="5" cols="40"></textarea></td>
    </tr>
   <tr>
        <td><label class="lbl">Tel</label></td>
        <td><label class="lbl">: </label></td>
        <td><input type="text" name="tel" id="tel"  class="txt"></td>
    </tr>  
   <tr>
        <td><label class="lbl">Fax</label></td>
        <td><label class="lbl">: </label></td>
        <td><input type="text" name="fax" id="fax" class="txt"></td>
    </tr>      
   <tr>
        <td><label class="lbl">Email</label></td>
        <td><label class="lbl">: </label></td>
        <td><input type="text" name="email" id="email" class="txt"></td>
    </tr>    
   <tr>
        <td><label class="lbl">Web site</label></td>
        <td><label class="lbl">: </label></td>
        <td><input type="text" name="website" id="website" class="txt"></td>
    </tr>  
   <tr>
        <td><label class="lbl">Type</label></td>
        <td><label class="lbl">: </label></td>
        <!--<td><input type="text" name="type" id="type" class="txt"></td>-->
        <td>
            <SELECT NAME=type id="type">
                <OPTION VALUE=0>Choose
                <?php  
                    $sql="SELECT * FROM bk_parameter where type='typcs'  order by id";
                    $result = mysqli_query($con,$sql);
                    while($row = mysqli_fetch_array($result))
                       {
                            $typename=$row["name"];
                            echo "<OPTION VALUE=\"$typename\">".$typename.'</option>';
                       }
               ?>
             </SELECT>
       </td>
   </tr> 
   <tr>

       <td></td>
       <td></td>
       <td><input type="submit" value="submit" name="submit" class="btn" onclick="change_action()">
           <input type="submit" value="back" name="back" class="btn" onclick="change_action()"></td>
   </tr>

</table>
</form>

<?php
include_once '../inc/footer.php';
?>

data.php

<?php
include_once '../inc/header.php';

//insert into table

if (isset($_POST['submit']) && $_POST['submit']  != "" )
    {

        $name = ($_POST["name"]);
        $address = ($_POST["address"]);
        $tel = ($_POST["tel"]);
        $fax = ($_POST["fax"]);
        $email = ($_POST["email"]);
        $website = ($_POST["website"]);
        $type = ($_POST["type"]);    
       try 
            { 
                $sql="INSERT INTO bk_customer (name,address,tel,fax,email,website,type)
                      VALUES ('$name','$address','$tel','$fax','$email','$website','$type')";
                $result = mysqli_query($con,$sql) ; 

            header("Location:index.php"); 
            exit();
            } 
        catch (Exception $ex) 
            {
               echo $e->getMessage() . "\n";
               file_put_contents('PDOErrors.txt', $e->getMessage(), FILE_APPEND);
               exit();            
            }
     }
//mysqli_close($con);

// update table
if (isset($_POST['update']) && $_POST['update']  != "" )

    {
        $id= ($_POST["id"]);
        $name = ($_POST["name"]);
        $address = ($_POST["address"]);
        $tel = ($_POST["tel"]);
        $fax = ($_POST["fax"]);
        $email = ($_POST["email"]);
        $website = ($_POST["website"]);
        $type = ($_POST["type"]);    

        try 
            {
            $sql="UPDATE bk_customer SET name='$name',address='$address', tel='$tel',fax='$fax',"
                    . "email='$email', website='$website',type='$type' WHERE id='$id'";
            $result = mysqli_query($con,$sql) ; 
            header("Location:index.php"); 
            } 
        catch (Exception $ex) 
            {
              echo $e->getMessage() . "\n";
              file_put_contents('PDOErrors.txt', $e->getMessage(), FILE_APPEND);
              exit();                   
            }
    }
// update record

if (isset($_POST['delete']) && $_POST['delete']  != "" )
    {
        $id=$_POST["id"];
        try
            {
            $sql="DELETE FROM bk_customer WHERE id='$id'";
            $result = mysqli_query($con,$sql) ; 
            header("Location:index.php");             
            } 
        catch (Exception $ex) 
            {
              echo $e->getMessage() . "\n";
              file_put_contents('PDOErrors.txt', $e->getMessage(), FILE_APPEND);
              exit();       
            }

    }

// back to index.php

if (isset($_POST['back']) && $_POST['back']  != "" )
    {
        header("Location:index.php"); 
    }

[sikander123]

 <!DOCTYPE HTML>
<html>
<head>
<style>
.error {color: #FF0000;}
</style>
</head>
<body>

<?php
// define variables and set to empty values
$nameErr = $emailErr = $genderErr = $websiteErr = "";
$name = $email = $gender = $comment = $website = "";

if ($_SERVER["REQUEST_METHOD"] == "POST")
{

   if (empty($_POST["name"]))
     {$nameErr = "Name is required";}
   else
     {$name = test_input($_POST["name"]);}

   if (empty($_POST["email"]))
     {$emailErr = "Email is required";}
   else
     {$email = test_input($_POST["email"]);}

   if (empty($_POST["website"]))
     {$website = "";}
   else
     {$website = test_input($_POST["website"]);}

   if (empty($_POST["comment"]))
     {$comment = "";}
   else
     {$comment = test_input($_POST["comment"]);}

   if (empty($_POST["gender"]))
     {$genderErr = "Gender is required";}
   else
     {$gender = test_input($_POST["gender"]);}

}

function test_input($data)
{
     $data = trim($data);
     $data = stripslashes($data);
     $data = htmlspecialchars($data);
     return $data;
}
?>

<h2>PHP Form Validation Example</h2>
<p><span class="error">* required field.</span></p>
<form method="post" action="<?php echo htmlspecialchars($_SERVER["PHP_SELF"]);?>">
   Name: <input type="text" name="name">
   <span class="error">* <?php echo $nameErr;?></span>
   <br><br>
   E-mail: <input type="text" name="email">
   <span class="error">* <?php echo $emailErr;?></span>
   <br><br>
   Website: <input type="text" name="website">
   <span class="error"><?php echo $websiteErr;?></span>
   <br><br>
   Comment: <textarea name="comment" rows="5" cols="40"></textarea>
   <br><br>
   Gender:
   <input type="radio" name="gender" value="female">Female
   <input type="radio" name="gender" value="male">Male
   <span class="error">* <?php echo $genderErr;?></span>
   <br><br>
   <input type="submit" name="submit" value="Submit">
</form>

<?php
echo "<h2>Your Input:</h2>";
echo $name;
echo "<br>";
echo $email;
echo "<br>";
echo $website;
echo "<br>";
echo $comment;
echo "<br>";
echo $gender;
?>

</body>
</html>

[Maideen]

hi sikander123

Thank you

I have two different php page. One add.php with html code and another is data.php. There is the code to insert into table. But I need to khow how to validate in html page. This is the confusing to me. If all in one page, can use your code.

maideen

[sikander123]

then you have to use javascript validation.

[sikander123]

/--------------------Javascript Code For Validation--------


$(document).ready(function () {

    $('#myform').validate({ // initialize the plugin
        rules: {
            field1: {
                required: true,
                email: true
            },
            field2: {
                required: true,
                minlength: 5
            }
        }
    });

});


/--------------------Form--------

<form id="myform">
    <input type="text" name="field1" />
    <input type="text" name="field2" />
    <input type="submit" />
</form>

[Maideen]

ok Thank you

I will try now and let you know...

[diafol]

You need to validate on the server too. Users can bypass js validation.
Check out the php filters:

http://www.php.net/manual/en/filter.examples.validation.php

http://www.php.net/manual/en/filter.examples.sanitization.php

[sikander123]

Welcome Maideen

[tutorials.scripts]

you can able to vaidate through js validation ... Click Here

[sikander123]

i think this is difficult for him.he have to include regular expressions for this.this is easy if you can use jquery.

[Tinnin]

I think it would be intersting for Maideen to have a look at the regex for email. It doesn't have to be complicated if all you look for is the basic structure. And besides, doesn't js use the same format?

[Tinnin]

The other option: http://www.php.net/manual/en/filter.filters.validate.php

[sikander123]

In your point of view reg expressions idea is best but in my point of view jquery is best for validation.i have work with both and i feel easy using jquery.But it depend on Maideen which he choose.

[diafol]

Guys - the OP requires server-side validation as he's inserting data into a DB. Javascript/Jquery, while useful for helping an user not make mistakes before submitting a form is absolutely useless for inserting into a DB. Please stop veering him in this direction. PHP filters as I linked and now Tinnin, have been developed for a reason and to ensure that we stop wasting time with developing leaky regex and constantly reinventing the wheel.