PHP验证表单，不带字符

Question

I have a problem.I need that the user can not send the form without having to write something I have this form :

 <div id="content" class="inner-wrapper reg"> <div id="mside"> <div class="section goback"> <div class="btn-back"><a class="back" onClick="history.go(-1)"><?= $lang['profile']['back'] ?></a></div> </div> <div class="section register"> <form id="mail-cons" method="post" action="" enctype="multipart/form-data" > <div class="step2"> <ul class="step-ul"> <h2>Asesoría vía correo electrónico</h2> <?//Primul pas pt user, descrierea problemei if(loggedtype()=='user' AND $data['user_description']==''){?> <div class="step-message sys-info"><img class='small icon' src='<?=$url_base?>css/images/icons/information.png' alt=''/> <?=$lang['mc']['user_step1']?></div> <div class="row mail-cnsl"> </div> <div class="row"> <textarea id="descriere2 " name="descriere" class="tinymce" rows="20" cols="50" style="width: 554px; height: 517px;"><?php echo $_REQUEST["descriere"];?></textarea> </div> <div class="row submit mail-cnsl"> <input type="submit" name="submitdesc" value="Enviar solicitud!" /> </div> <? } ?> 

And this function for validation:

 <script type="text/javascript"> function validate_required(field,alerttxt) { with (field) { if (value==null||value=="") { alert(alerttxt);return false; } else { return true; } } } function validate_form(thisform) { with (thisform) { if(window.clicked) return true; if (validate_required(user_description_extra,"Por favor, introduzca el motivo del rechazo!")==false) {user_description_extra.focus();return false;} } } </script> <script type="text/javascript"> function validate_length(f,a,l){ z=f.value; x=z.length; if (x<l){alert (a); f.focus(); return false;} return true; } </script> 

And this function for submit :

 if(isset($_POST['submitdesc'])){ $upd = mysql_query("UPDATE discussion SET active='0' WHERE id='".$_GET['iddisc']."'") or die(mysql_error()); $sel = mysql_query("SELECT * FROM discussion WHERE id='".$_GET['iddisc']."'") or die(mysql_error()); $data = mysql_fetch_array($sel); $upd_mc = mysql_query("UPDATE mail_counseling SET new_user=0, new_cons=1, user_description='".mysql_real_escape_string($_POST['descriere'])."' WHERE id_disc='".$_GET['iddisc']."'") or die(mysql_error()); //Notificari if($_SESSION['loggedin']['type']=='user'){ $insid = $user['id_user']; $type1 = 'user'; $type2 = 'client'; }else{ $insid = $cons['id_counselor']; $type1 = 'consilier'; $type2 = 'counselor'; } $insnotifs = mysql_query("INSERT INTO mc_notifs (type,id_user,message) VALUES ('".$_SESSION['loggedin']['type']."','".$insid."','".mysql_real_escape_string($message)."')") or die(mysql_error()); //End Notificari //Send notification mail $query_tpl_mail = "SELECT * FROM mails WHERE id_mails='6'"; $tpl_mail = mysql_query($query_tpl_mail, $conn) or die(mysql_error()); $row_tpl_mail = mysql_fetch_assoc($tpl_mail); $subject = $row_tpl_mail['title_mail'.$lng_s_tb]; $message = $row_tpl_mail['description'.$lng_s_tb]; avertizare_mail($cons["email"],$subject,$lang['mc']['notif1']); avertizare_mail($user["email"],$subject,$lang['mc']['notif11']); header("Location: ".$url_base."$tip_user-account/mail-counseling/ok/"); exit; } 

But don't work .Can I help my?

Answer 1

Do not rely on the client side validation. Turning off javascript may leave your form vulnerable. You must do this work in php more securely and easily.

if(isset($_POST['submitdesc'])){

    $desc = htmlspecialchars(trim($_POST['descriere']))); 

    if(isset($desc)){
           $upd = mysql_query("UPDATE discussion SET active='0' WHERE id='".$_GET['iddisc']."'") or die(mysql_error());

   $sel = mysql_query("SELECT * FROM discussion WHERE id='".$_GET['iddisc']."'") or die(mysql_error());
   $data = mysql_fetch_array($sel);

   $upd_mc = mysql_query("UPDATE mail_counseling SET new_user=0, new_cons=1, user_description='".mysql_real_escape_string($_POST['descriere'])."' WHERE id_disc='".$_GET['iddisc']."'") or die(mysql_error());

   //Notificari
   if($_SESSION['loggedin']['type']=='user'){
      $insid = $user['id_user'];
      $type1 = 'user';
      $type2 = 'client';
   }else{
      $insid = $cons['id_counselor'];
      $type1 = 'consilier';
      $type2 = 'counselor';
   }



   $insnotifs = mysql_query("INSERT INTO mc_notifs (type,id_user,message) VALUES ('".$_SESSION['loggedin']['type']."','".$insid."','".mysql_real_escape_string($message)."')") or die(mysql_error());
   //End Notificari

   //Send notification mail
   $query_tpl_mail = "SELECT * FROM mails WHERE id_mails='6'";
   $tpl_mail = mysql_query($query_tpl_mail, $conn) or die(mysql_error());
   $row_tpl_mail = mysql_fetch_assoc($tpl_mail);

   $subject = $row_tpl_mail['title_mail'.$lng_s_tb];
   $message = $row_tpl_mail['description'.$lng_s_tb];
   avertizare_mail($cons["email"],$subject,$lang['mc']['notif1']);
   avertizare_mail($user["email"],$subject,$lang['mc']['notif11']);
   header("Location: ".$url_base."$tip_user-account/mail-counseling/ok/");
   exit;
    }else{
       ?><script>alert('Empty text field is not allowed.')</script><?php
    }
}