Member Avatar for SpottyBlue

Hi,

Is there a PHP script that doesn't allow the approver to be the same as the login e-mail?

$checkEmail = test_input($_POST["Approved_by_Email"]);
if (filter_var($checkEmail == session('session_staff_email'))) {
alert("Please do not use your e-mail as the approver.");
return false;
}

I tried to solve the problem, but it's so difficult to do. Here is the code that I'm trying to do.
"Approved_by_Email" is the text box.

  • 2 Contributors
  • 1 Reply
  • 407 Views
  • 2 Days Discussion Span
  • Latest Post Latest Post by Dani

Dani AI

Generated

Short answer: do the check on the server, compare normalized emails (case‑insensitive), and ideally compare user IDs rather than raw emails. — the common mistakes are calling a filter function on a boolean result, not starting the session, or relying only on client-side checks. — clarify whether the approver must be a different account (best) or simply a different email string.

A minimal, safe server-side pattern:

<?php
session_start(); // required for $_SESSION

$approved = trim($_POST['Approved_by_Email'] ?? '');
$approved = filter_var($approved, FILTER_SANITIZE_EMAIL);

if (!filter_var($approved, FILTER_VALIDATE_EMAIL)) {
    $error = 'Enter a valid approver email.';
} else {
    $logged = trim($_SESSION['staff_email'] ?? '');
    if ($logged !== '' && strcasecmp($approved, $logged) === 0) {
        $error = 'Please do not use your e-mail as the approver.';
    }
}

// stop processing and return $error to the form if set

Optional client-side convenience check (never a substitute for the server check):

document.querySelector('form').addEventListener('submit', function(e){
  var approved = document.querySelector('[name="Approved_by_Email"]').value.trim().toLowerCase();
  var logged = '<?= addslashes(strtolower($_SESSION['staff_email'] ?? '')) ?>';
  if (approved && approved === logged) {
    alert('Please do not use your e-mail as the approver.');
    e.preventDefault();
  }
});

Extra tips: enforce the rule by comparing user IDs fetched from your users table (more reliable than email), confirm the approver exists and has permission, always server-validate, call session_start() before using $_SESSION, and use var_dump($_POST, $_SESSION) while debugging.

Member Avatar for Dani

Sorry, I'm not understanding what you're trying to do. It looks like you're checking to see if an email is the same as a staff's email address, and if it is, don't use your own email?

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.