PHP Form Validation

PHP Form Validation: Cleaning and Checking User Input

PHP form validation verifies that submitted form fields match expected formats and business rules before your server stores them or sends emails. Browser HTML attributes like required or type="email" help users type faster, but attackers can bypass client checks with a single HTTP request.

Sanitization vs Validation

Treat cleaning and checking as two distinct steps in your request pipeline.

flowchart LR
    A["Raw $_POST Input"] --> B["Trim Whitespace"]
    B --> C["Validate Format and Length"]
    C -->|"Invalid"| D["Collect Field Errors"]
    C -->|"Valid"| E["Save to Database"]
    E --> F["Escape on HTML Output"]

First, normalize strings with trim() so accidental leading spaces do not pass required checks. Next, validate types and formats with filter_var(), mb_strlen(), or strict allowlists instead of stripping characters silently.

<?php
declare(strict_types=1);

function validateContactForm(array $input): array
{
    $errors = [];
    $name = trim((string) ($input['name'] ?? ''));
    $email = trim((string) ($input['email'] ?? ''));
    $age = filter_var($input['age'] ?? null, FILTER_VALIDATE_INT, [
        'options' => ['min_range' => 13, 'max_range' => 120],
    ]);

    if (mb_strlen($name) < 2 || mb_strlen($name) > 80) {
        $errors['name'] = 'Name must be between 2 and 80 characters.';
    }
    if (!filter_var($email, FILTER_VALIDATE_EMAIL)) {
        $errors['email'] = 'Please enter a valid email address.';
    }
    if ($age === false) {
        $errors['age'] = 'Age must be a whole number from 13 to 120.';
    }

    return $errors;
}

print_r(validateContactForm(['name' => 'A', 'email' => 'bad-email', 'age' => '10']));

Escaping Output When Rendering Errors

When re-displaying user input alongside error messages, pass every echoed value through htmlspecialchars($value, ENT_QUOTES, 'UTF-8'). Keep validation separate from output escaping so database values remain uncorrupted by HTML entities.

Common Mistakes to Avoid

• Validating without trimming first: Entering " " passes empty() checks unless you call trim() before measuring length.
• Using FILTER_SANITIZE_STRING: That filter was deprecated in PHP 8.1 and removed in newer releases. Validate format explicitly and escape on output instead.
• Stopping on the first error: Collect all field errors in an $errors array so users can fix every mistake in one pass.

Frequently Asked Questions

Should I escape HTML entities before saving to MySQL?

No. Store clean validated strings in the database and escape with htmlspecialchars() only when rendering HTML views.

Why did filter_var("0", FILTER_VALIDATE_INT) return 0 instead of true?

FILTER_VALIDATE_INT returns the parsed integer on success and false on failure, so compare with === false rather than !$result.

How do I validate select dropdown values safely?

Use in_array($role, ['student', 'instructor'], true) against an explicit list of allowed values.