PHP Form Validation – Step-by-Step Guide

What is Form Validation in PHP?

PHP Form Validation is the process of checking user input for accuracy, completeness, and security before storing or processing the data.

✅ Prevents invalid data submission
✅ Protects against security threats like XSS and SQL Injection
✅ Enhances user experience

Create an HTML Form

<form method="POST" action="<?php echo htmlspecialchars($_SERVER["PHP_SELF"]); ?>">
    <label for="name">Name:</label>
    <input type="text" name="name">
    
    <label for="email">Email:</label>
    <input type="email" name="email">

    <label for="age">Age:</label>
    <input type="number" name="age">

    <input type="submit" value="Submit">
</form>

Handling Form Data in PHP

Step 1: Initialize Variables

$name = $email = $age = "";
$nameErr = $emailErr = $ageErr = "";

Step 2: Check if the Form is Submitted

if ($_SERVER["REQUEST_METHOD"] == "POST") {
    // Validate Name
    if (empty($_POST["name"])) {
        $nameErr = "Name is required";
    } else {
        $name = validateInput($_POST["name"]);
        if (!preg_match("/^[a-zA-Z ]*$/", $name)) {
            $nameErr = "Only letters and spaces allowed";
        }
    }

    // Validate Email
    if (empty($_POST["email"])) {
        $emailErr = "Email is required";
    } else {
        $email = validateInput($_POST["email"]);
        if (!filter_var($email, FILTER_VALIDATE_EMAIL)) {
            $emailErr = "Invalid email format";
        }
    }

    // Validate Age
    if (empty($_POST["age"])) {
        $ageErr = "Age is required";
    } elseif (!filter_var($_POST["age"], FILTER_VALIDATE_INT)) {
        $ageErr = "Invalid age format";
    } else {
        $age = validateInput($_POST["age"]);
    }
}

Input Validation Function

function validateInput($data) {
    $data = trim($data);       // Remove extra spaces
    $data = stripslashes($data); // Remove backslashes
    $data = htmlspecialchars($data); // Convert special characters
    return $data;
}

Displaying Errors and Data

<p style="color: red;"><?php echo $nameErr; ?></p>
<p style="color: red;"><?php echo $emailErr; ?></p>
<p style="color: red;"><?php echo $ageErr; ?></p>

<h3>Your Input:</h3>
<p>Name: <?php echo $name; ?></p>
<p>Email: <?php echo $email; ?></p>
<p>Age: <?php echo $age; ?></p>

What are the Best Practices for handling Form Validation in php

✅ Use htmlspecialchars() to prevent XSS attacks
✅ Use filter_var() for email and number validation
✅ Implement server-side validation, even if you have client-side JavaScript validation
✅ Prevent CSRF attacks by using tokens
✅ Sanitize data before storing it in the database