What are some best practices for validating user input in a PHP contact form?

Validating user input in a PHP contact form is crucial to ensure that the data submitted is accurate and secure. Some best practices include checking for required fields, validating email addresses, sanitizing input to prevent SQL injection attacks, and using regular expressions to validate specific formats like phone numbers. 

// Validate required fields
if(empty($_POST['name']) || empty($_POST['email']) || empty($_POST['message'])){
    // Handle error
}

// Validate email address
if(!filter_var($_POST['email'], FILTER_VALIDATE_EMAIL)){
    // Handle error
}

// Sanitize input to prevent SQL injection
$name = mysqli_real_escape_string($conn, $_POST['name']);
$email = mysqli_real_escape_string($conn, $_POST['email']);
$message = mysqli_real_escape_string($conn, $_POST['message']);

// Validate phone number format using regular expression
$phone_pattern = "/^\d{3}-\d{3}-\d{4}$/";
if(!preg_match($phone_pattern, $_POST['phone'])){
    // Handle error
}

Keywords

form validation user input PHP security error handling

Related Questions