使用php验证html表单

Question

I have a form which needs to be validated using php before inserting form values into a database.

it worked just fine if the fields are empty, however when I included a code to ensure only letters and white spaces are allowed in the first and last name fields it broke the validation process ie when I typed in any combinations of letters in the fields it displayed an error message saying "only letters and white spaces are required".

Secondly, when all fields are empty, the form displays the appropriate error message and does no submit the form to the database. However, when I type in a message in the textarea field with other fields empty, the form submits the data to the database as well as displays error messages for the other empty fields.

Any help to resolve these issues would be much appreciated.

Here is the code:

    <?php
    $fnameErr = $lnameErr = $emailErr = $amountErr = $phoneErr = $genderErr = $messageErr = $categoryErr = $countryErr = "";
     $fname = $lname =  $email = $amount = $phone  =  $gender  = $message = $category = $country = "";
    $ipaddress ="";
    $defaultMessage = "Please type your message here.";

 $formErrors = false;
 if ($_SERVER["REQUEST_METHOD"] == "POST") {

     //for first name
     $name= $_POST["fname"];
     if (empty($_POST["fname"])){
        $fnameErr = "Please, enter your first name";
        $formErrors = true;
    }elseif(!preg_match("/^[a-zA-Z]*&/", $name)){
        $fnameErr = "Only letters and white spaces are allowed in the first name field";
        $formErrors = true;
    }else{
        $fname = $_POST["fname"];
        $formErrors = false;
    }


    //Last Name match
    // for last name
     $name2= $_POST["lname"];
    if (empty($_POST["lname"])){
        $lnameErr = "Please, enter your last name";
        $formErrors = true;
    }elseif(!preg_match("/^[a-zA-Z]*&/", $name2)){
        $lnameErr = "Only letters and white spaces are allowed in the Last name field";
        $formErrors = true;
    }else{
        $lname = $_POST["lname"];
        $formErrors = false;
    }


    // for email format
     $emailf =($_POST["email"]);
    if (empty($_POST["email"]))  {
        $emailErr = "Please, enter your email";
        $formErrors = true;
    }elseif (!filter_var($emailf, FILTER_VALIDATE_EMAIL)) {
        $emailErr = "Invalid email format"; 
        $formErrors = true;
     }else {
        $email = $_POST["email"];
        $formErrors = false;
    }


    //for phone
     if (empty($_POST["phone"])){
         $phoneErr = "Please, enter your phone number";
         $formErrors = true;
     }else{
        $phone = $_POST["phone"];
        $formErrors = false;
    }


     // for amount
    if (!isset($_POST["amount"])) {
        $amountErr = "You must select an amount";
        $formErrors = true;
    }
    else {
        $amount = $_POST["amount"];
        $formErrors = false;
    }

     // for gender
     if (!isset($_POST["gender"])) {
        $genderErr = "You must select your gender";
        $formErrors = true;
    }
    else {
        $gender = $_POST["gender"];
        $formErrors = false;
    }


     // for country
     if (empty($_POST["country"]) || $_POST["country"] == "Country") {
        $countryErr = "Please, select your country";
        $formErrors = true;
    }
    else {
        $country = $_POST["country"];
        $formErrors = false;
    }

      // for category
     if (empty($_POST["category"]) || $_POST["category"] == "Category") {
        $categoryErr = "Please, select a category";
        $formErrors = true;
    } else {
        $category = $_POST["category"];
        $formErrors = false;
    }

     // for message
     if (empty($_POST["message"]) || $_POST["message"] == $defaultMessage){
        $messageErr = "Please type your prayer request";
        $formErrors = true;
    }else{
        $message = $_POST["message"];
        $formErrors = false;
    }

    if (empty($formErrors) ) {
        //connect to database
         require_once("../../includes/connect_to_db.php");

       // set time zone to uk
       $timezone = date_default_timezone_set("Europe/london");


        //setting values 
        $Timestamp = date('Y-m-d h:i:s');
        $fname = $_POST["fname"];
        $lname = $_POST["lname"];
        $email = $_POST["email"];
        $phone = $_POST["phone"];
        $gender = isset($_POST["gender"]) ? $_POST["gender"] : ''; 
        $message = $_POST["message"]; 
        $country = $_POST["country"]; 
        $category = $_POST["category"]; 

        //echo $gender . "value";
        //var_dump(billingDate);
        // var_dump($customer);

        //Escape all string
        $firstname = mysqli_real_escape_string($connection, $fname);
        $lastname = mysqli_real_escape_string($connection, $lname);
        $emailNew = mysqli_real_escape_string($connection, $email);
        $phoneNew = mysqli_real_escape_string($connection, $phone);
        $genderNew = mysqli_real_escape_string($connection, $gender);
        $messageNew = mysqli_real_escape_string($connection, $message);
        $countryNew = mysqli_real_escape_string($connection, $country);
        $categoryNew = mysqli_real_escape_string($connection, $category);

        //querying the database
        $query = "INSERT into counselling ( ";
        $query .= "Timestamp, FirstName, LastName, ";
        $query .= "Email, PhoneNumber, Category, Country, Gender, Message";
        $query .= ")";
        $query .= "VALUES ('{$Timestamp}', '{$firstname}', '{$lastname}', ";
        $query .= "'{$emailNew}', '{$phoneNew}', '{$categoryNew}', '{$countryNew}', '{$genderNew}', '{$messageNew}' ";
        $query .= ")";

        echo $query;

        $result = mysqli_query($connection, $query) ;

        //check for query error
        if($result){
            //query success redirect_to ("somepage.php");
           //redirect_to("confirmation.php");
            echo "Success";
        } else {
             die("Database query failed");
        }

    } // end of if

  } // End of form submission conditional. 
?>

Answer 1

Your need to refactor your code with proper logic.

<?php
$fname = $_POST["fname"];
$lname = $_POST["lname"];

$errors = array();

if(trim($fname) == ''){
    $errors['fname'] = "First name is required";
}


if(trim($lname) == ''){
    $errors['lname'] = "Last name is required";
}

if(count( $errors) > 0){
  //form invalid
}
else{
   //form is valid
}