PHP Form Required

PHP Forms - Handling Required Fields

This chapter demonstrates how to enforce required input fields in HTML forms using PHP and display user-friendly error messages.

PHP - Identifying Required Fields

In many web forms, certain information is essential. For example, user registration typically requires a name and email, while checkout forms need address details. We mark these as ‘required’.

Let’s define validation rules for a sample form:

Field	Validation Rules
Name	Required. Must only contain letters and whitespace.
E-mail	Required. Must contain a valid email address format.
Website	Optional. If provided, must be a valid URL.
Comment	Optional. Multi-line text input.
Gender	Required. Must select one option.

In previous examples, all fields might have been optional. Now, we’ll ensure the required ones (‘Name’, ‘E-mail’, ‘Gender’) are not submitted empty.

To manage this, we’ll introduce variables to hold potential error messages (e.g., $nameErr, $emailErr, $genderErr). We’ll check each corresponding $_POST value when the form is submitted. PHP’s empty() function is useful here. If a required field is empty, we store an error message. Otherwise, we sanitize the input using a helper function (like sanitizeInput) before using it.

<?php
// Function to sanitize input data
function sanitizeInput(string $data): string {
    $data = trim($data);
    $data = stripslashes($data);
    $data = htmlspecialchars($data);
    return $data;
}

// Define variables and initialize with empty values
$nameErr = $emailErr = $genderErr = $websiteErr = "";
$name = $email = $gender = $comment = $website = "";

// Check if the form was submitted using POST method
if ($_SERVER["REQUEST_METHOD"] === "POST") {

    // Validate Name (Required)
    if (empty($_POST["name"])) {
        $nameErr = "Name is required";
    } else {
        $name = sanitizeInput($_POST["name"]);
        // Add further validation if needed (e.g., regex for letters/whitespace)
    }

    // Validate Email (Required)
    if (empty($_POST["email"])) {
        $emailErr = "Email is required";
    } else {
        $email = sanitizeInput($_POST["email"]);
        // Add further validation for email format using filter_var()
        if (!filter_var($email, FILTER_VALIDATE_EMAIL)) {
            $emailErr = "Invalid email format";
        }
    }

    // Validate Website (Optional)
    if (empty($_POST["website"])) {
        $website = "";
    } else {
        $website = sanitizeInput($_POST["website"]);
        // Add further validation for URL format using filter_var()
        if (!filter_var($website, FILTER_VALIDATE_URL)) {
            $websiteErr = "Invalid URL format";
        }
    }

    // Validate Comment (Optional)
    if (empty($_POST["comment"])) {
        $comment = "";
    } else {
        $comment = sanitizeInput($_POST["comment"]);
    }

    // Validate Gender (Required)
    if (empty($_POST["gender"])) {
        $genderErr = "Gender is required";
    } else {
        $gender = sanitizeInput($_POST["gender"]);
    }
}
?>

Notice the use of === "POST" for stricter comparison and filter_var() for built-in email and URL validation, which is generally more reliable than custom regular expressions for these common tasks.

PHP - Displaying Error Messages in the Form

Now, let’s modify the HTML form to display these error messages next to the respective fields. We use simple PHP echo statements within <span> tags (often styled with CSS to appear in red). The htmlspecialchars($_SERVER["PHP_SELF"]) ensures the form submits to the same page securely, preventing Cross-Site Scripting (XSS) vulnerabilities.

<!DOCTYPE html>
<html>
<head>
<style>
.error {color: #FF0000;}
</style>
</head>
<body>

<h2>PHP Form Validation Example</h2>
<p><span class="error">* required field</span></p>
<form method="post" action="<?php echo htmlspecialchars($_SERVER["PHP_SELF"]);?>">

    Name: <input type="text" name="name" value="<?php echo htmlspecialchars($name);?>">
    <span class="error">* <?php echo $nameErr;?></span>
    <br><br>

    E-mail: <input type="text" name="email" value="<?php echo htmlspecialchars($email);?>">
    <span class="error">* <?php echo $emailErr;?></span>
    <br><br>

    Website: <input type="text" name="website" value="<?php echo htmlspecialchars($website);?>">
    <span class="error"><?php echo $websiteErr;?></span>
    <br><br>

    Comment: <textarea name="comment" rows="5" cols="40"><?php echo htmlspecialchars($comment);?></textarea>
    <br><br>

    Gender:
    <input type="radio" name="gender" <?php if (isset($gender) && $gender=="female") echo "checked";?> value="female">Female
    <input type="radio" name="gender" <?php if (isset($gender) && $gender=="male") echo "checked";?> value="male">Male
    <input type="radio" name="gender" <?php if (isset($gender) && $gender=="other") echo "checked";?> value="other">Other
    <span class="error">* <?php echo $genderErr;?></span>
    <br><br>

    <input type="submit" name="submit" value="Submit">

</form>

<?php
// Optional: Display submitted data after successful validation
if ($_SERVER["REQUEST_METHOD"] === "POST" && empty($nameErr) && empty($emailErr) && empty($genderErr) && empty($websiteErr)) {
    echo "<h2>Your Input:</h2>";
    echo "Name: " . $name . "<br>";
    echo "Email: " . $email . "<br>";
    echo "Website: " . $website . "<br>";
    echo "Comment: " . $comment . "<br>";
    echo "Gender: " . $gender;
}
?>

</body>
</html>

Key improvements in the form:

• Added value="<?php echo htmlspecialchars($variable);?>" to inputs to repopulate the form with submitted data (sticky forms), improving user experience.
• Used htmlspecialchars() when echoing user data back into the form to prevent XSS.
• Improved radio button handling to correctly show the selected option after submission.
• Added a section to display the submitted data only if there are no validation errors.

The next step involves refining the validation logic. For example, ensuring the ‘Name’ field truly contains only letters and whitespace using regular expressions (preg_match()), or checking if the ‘Website’, if provided, has a valid URL structure using filter_var().