What are some best practices for validating form input using PHP?

Validating form input is crucial to ensure that the data submitted by users is accurate and secure. Some best practices for validating form input using PHP include checking for required fields, validating email addresses, sanitizing input to prevent SQL injection attacks, and using regular expressions to enforce specific formats for input data. 

// Example of validating form input in PHP

// Check if a required field is empty
if (empty($_POST['username'])) {
    $errors[] = "Username is required";
}

// Validate email address format
if (!filter_var($_POST['email'], FILTER_VALIDATE_EMAIL)) {
    $errors[] = "Invalid email address";
}

// Sanitize input to prevent SQL injection
$username = mysqli_real_escape_string($conn, $_POST['username']);

// Use regular expressions to enforce specific formats
if (!preg_match("/^[0-9]{3}-[0-9]{3}-[0-9]{4}$/", $_POST['phone'])) {
    $errors[] = "Invalid phone number format";
}

// Display errors if any
if (!empty($errors)) {
    foreach ($errors as $error) {
        echo $error . "<br>";
    }
}

Keywords

filter_var htmlspecialchars validation sanitize input validation

Related Questions