Form Validation and Sanitizing User Input in PHP

codevigyaan php

Validation and sanitizing user input in PHP allows us to create secure, robust web applications. validation is the process of determining if the data inserted is correct. Sanitizing is the removing of unwanted characters from it before PHP uses it. Both allow robust applications.

What Is Form Validation

A form validation in PHP confirms that the data submitted is valid according to the validation rule. For instance, the Form validation requires that the entries should not blank, and also that it follow the correct format. Therefore, validation is useful to avoid unusable data being used.

Validation is widely used to verify the data by:
Mandatory fields
Email format
Length of password
Numbers

What Is Input Sanitization

Input sanitization removes any unwanted characters from form data. User input validation is used to checked for correctness, but sanitization is used to check for safety. So, always use both.

The following are examples of typical cleaning jobs:
Deleting unnecessary free spaces
Removes special characters
Cleaning email addresses

Why Validation and Sanitization Are Important

Without validation, forms could save invalid data. And without sanitising, forms could save malicious data. That‘s why PHP developers need to use both of them.

Basic Example with Validation and Sanitization

HTML Form

//Post Method
<form method="post">
    <input type="text" name="username" placeholder="Username">
    <input type="email" name="email" placeholder="Email">
    <input type="submit" name="submit" value="Submit">
</form>

PHP Code

<?php
if (isset($_POST['submit'])) {

    $username = trim($_POST['username']);
    $email = trim($_POST['email']);

    if (empty($username)) {
        echo "Username is required<br>";
    }

    if (!filter_var($email, FILTER_VALIDATE_EMAIL)) {
        echo "Please enter a valid email<br>";
    }
}
?>

In this example PHP cleans the input then tests if the data is right.

Using filter_input for Better Safety

PHP itself includes functions to clean and validate input.

$email = filter_input(INPUT_POST, 'email', FILTER_SANITIZE_EMAIL);

if (!filter_var($email, FILTER_VALIDATE_EMAIL)) {
    echo "Invalid email address";
}

This makes it more secure and easier to read.

Common Mistakes Beginners Should Avoid

Do not trust user input.
Never skip server side validation. Changes on the server side affect to the database. Validation is made this is impossible to hack and has made the application more secure.
Never use Get Method for sensitive information.
Present raw input only.

Best Practices for Beginners

Always validate user input on the server side
Sanitize data before using it
Give crisp error messages
Validation and sanitization together

Summary

Validation and sanitization, are both used working together validating the user input, in PHP, the validation is validating the rules for the user and the sanitization is doing the cleaning of the data. They both can be used by PHP beginners to make safe PHP forms.

Looking for clean code? Explore our latest Bootstrap Projects.

Want to stay ahead of the curve? Download our latest tech guides in the Free E-Books section.