PHP Form Validation

PHP Form Validation

When dealing with HTML forms, the absolute most important rule in web development is: Never trust user input.

Hackers and malicious bots can submit harmful code into your forms. If you process that data without checking it first, your website could be compromised. This is why Form Validation is crucial.

The Threat: Cross-Site Scripting (XSS)

Imagine a user submits the following script into a comment form: <script>alert('Your site is hacked!');</script>

If your PHP code takes that input and prints it directly back to the screen, the browser will execute the script! This is called a Cross-Site Scripting (XSS) attack.

Defending with htmlspecialchars()

The easiest way to prevent XSS attacks in PHP is by using the htmlspecialchars() function.

This function converts special HTML characters into their safe, harmless entity equivalents. For example, it translates < and > into < and >. The browser will simply display the text instead of executing it as code.

<?php
// A malicious user tries to submit a script
$bad_input = "<script>alert('Hacked!');</script>";

// We clean the input before doing anything with it
$safe_input = htmlspecialchars($bad_input);
echo "Safe Output: " . $safe_input;
?>

Creating a Custom Data Cleaning Function

To make validation easy, we should create a reusable function that runs every piece of form data through three important steps:

1. trim(): Removes unnecessary spaces, tabs, and newlines from both sides of the string.
2. stripslashes(): Removes backslashes (\) that hackers might use to escape secure code.
3. htmlspecialchars(): Converts HTML tags into safe text.

Here is the standard cleaning function used by professional PHP developers:

function test_input($data) {
  $data = trim($data);
  $data = stripslashes($data);
  $data = htmlspecialchars($data);
  return $data;
}

In the next chapter, we will use this test_input() function to securely validate mandatory form fields!