PHP Form Validation

PHP Input Sanitization & Form Validation

Form validation ensures that user input matches required data formats, character limits, and constraints before saving to a database or executing application logic. Sanitization strips unwanted HTML markup and malicious characters to prevent Cross-Site Scripting (XSS) attacks.

Validation vs Sanitization

• Sanitization: Cleaning/stripping input characters (e.g. htmlspecialchars(), strip_tags()).
• Validation: Verifying if input meets structural requirements (e.g. checking length, valid email syntax).

flowchart TD
    A["Raw User Input ($_POST / $_GET)"] --> B["Trim Whitespace: trim()"]
    B --> C["Strip Unsafe Markup: htmlspecialchars()"]
    C --> D{"Validate Format Constraints"}
    D -- Pass --> E["Proceed with Business Logic"]
    D -- Fail --> F["Return User Errors Array"]

Practical Code Example

<?php
declare(strict_types=1);

function sanitizeInput(string $data): string
{
    $data = trim($data);
    $data = stripslashes($data);
    return htmlspecialchars($data, ENT_QUOTES, 'UTF-8');
}

$errors = [];
$formData = [];

if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    // 1. Process & Sanitize Full Name
    $rawName = $_POST['name'] ?? '';
    $cleanName = sanitizeInput($rawName);
    if (empty($cleanName)) {
        $errors['name'] = "Name field cannot be left blank.";
    } else {
        $formData['name'] = $cleanName;
    }

    // 2. Process & Validate Age
    $rawAge = $_POST['age'] ?? '';
    if (!filter_var($rawAge, FILTER_VALIDATE_INT, ["options" => ["min_range" => 18, "max_range" => 100]])) {
        $errors['age'] = "Age must be a valid integer between 18 and 100.";
    } else {
        $formData['age'] = (int)$rawAge;
    }
}

Best Practices

• Always Validate on the Server Side: Never rely solely on client-side HTML5 or JavaScript validation, as client validation can be bypassed by malicious HTTP requests.
• Use htmlspecialchars($str, ENT_QUOTES, 'UTF-8'): Converts both single and double quotes to HTML entities preventing script injection.
• Store Validation Errors in Associative Arrays: Collects all field errors to re-render friendly inline feedback to users.

Self-Check Challenge

Write a sanitization function cleanField(string $input): string that trims whitespace, removes slashes, and escapes HTML special characters!