PHP Server Side Form Validation

In this article, you will learn how to validate an HTML form using PHP. It is important to validate the form data submitted by users because it may contain some inappropriate values that can harm your software. Form validation also helps the user to provide inputs in correct format.

In this article, we are using server side form validation. As it is more secure than client side form validation. Because, if you are validating a HTML form using javascript client side form validation and suppose the user has turn off the Javascript on the client browser then this is not working. Server side form validation is done on the server side after the data has been submitted. This validates the data before storing it in database.

For this, let's first create a sample HTML form that collect employee information then we will create a php file that will contain form validation code.

employeeform.php
In this file, the html form contains five input files to collect employee information and a submit button. We have included the form validation file form_validation.php at the top.

<?php
  include('form_validation.php'); 
?>

<form action="" method="post" name="emp_form">
 Employee Name: <input type="text" name="emp_name" value="<?php echo $emp_name; ?>" />
 <?php echo $error_empname; ?>
 <br/>
 Email: <input type="text" name="email" value="<?php echo $emp_email; ?>" />
 <?php echo $error_email; ?>
 <br/>
 Phone: <input type="text" name="phone" value="<?php echo $emp_ph; ?>" />
 <?php echo $error_ph; ?>
 <br/> 
 Username: <input type="text" name="username" value="<?php echo $emp_uname; ?>" />
 <?php echo $error_username; ?>
 <br/>
 Password: <input type="password" name="password" value="<?php echo $password; ?>" />
 <?php echo $error_password; ?>
 <br/>
 Confirm Password: <input type="password" name="confirm" value="<?php echo $confirm; ?>" />
 <?php echo $error_confirm; ?>
 <br/>
 <input type="submit" name="Submit" value="Submit" />
</form>

form_validation.php, the PHP validation code is here for validating the above HTML Form.

<?php
 if(isset($_POST['Submit'])){

 $emp_name=trim($_POST["emp_name"]);
 $emp_email=trim($_POST["email"]);
 $emp_ph=trim($_POST["phone"]);
 $emp_uname=trim($_POST["username"]);
 $password=trim($_POST["password"]);
 $confirm=trim($_POST["confirm"]);

 if($emp_name =="") {
   $error_empname=  "Please enter your name.";
 }

 elseif($emp_email == "") {
   $error_email=  "Please enter your email"; 
 } 

 elseif(!preg_match("/^[_\.0-9a-zA-Z-]+@([0-9a-zA-Z][0-9a-zA-Z-]+\.)+[a-zA-Z]{2,6}$/i", $emp_email)){
   $error_email= 'Please enter valide email, like This email address is being protected from spambots. You need JavaScript enabled to view it.';
 }

 elseif($emp_ph == ""){
   $error_ph =  "Please enter phone number.";
 }

 elseif(is_numeric(trim($emp_ph)) == false){
   $error_ph =  "Please enter numeric value.";
 }

 elseif($emp_uname == ""){
   $error_username =  "Please enter uername.";
 }

 elseif(strlen($emp_uname)<5){
   $error_username =  "Username should be atleast five characters.";
 }

 elseif($password == ""){
   $error_password=  "Please enter password";
 }

 elseif($confirm == ""){
   $error_confirm=  "Please enter confirm password";
 }

 elseif($password != $confirm) {
   $error_confirm=  "Password and confirm password does not match";
 }

 else{
   // Mysql insert statement
   // After successful form submission, it will be redirect to thankyou.php file.
   header("Location: thankyou.php");
 }
}
?>

In the above code, isset() function first checks whether form is submitted or not. If it is then it trims all the whitespace of field values using trim() function. After this, it checks each field value separately.