Can I remove “&& isset” in a php form

Question

I have got the following form to work using PHP and JavaScript to validate... The problem is, each time I want to update the inputs in the form I need to also update the && isset and $input = $_REQUEST['input name']; in the PHP! Are these important? there is no way to make the whole process easier?! please advise

PHP:

<?php
   session_start();

   if ($_SERVER['REQUEST_METHOD'] == 'POST'){
      ob_start();

      if(isset($_REQUEST['name'])
      && isset($_REQUEST['email'])
      && isset($_REQUEST['message'])
      && isset($_REQUEST['number'])
      && isset($_REQUEST['date'])
      && isset($_REQUEST['select'])
      && isset($_REQUEST['radio'])
      && isset($_REQUEST['checkbox'])
      && isset($_REQUEST['token'])){

         if($_SESSION['token'] != $_POST['token']){
            $response = "0";
         } else {
            $_SESSION['token'] = "";
            $name = $_REQUEST['name'];
            $email = $_REQUEST['email'];
            $message = $_REQUEST['message'];
            $number = $_REQUEST['number'];
            $date = $_REQUEST['date'];
            $select = $_REQUEST['select'];
            $radio = $_REQUEST['radio'];
            $checkbox = $_REQUEST['checkbox'];

            $to = "";
            $subject = "New Message From: $name";
            $message = "Name: $name<br/>
                        number: $number<br/>
                        date: $date<br/>
                        select: $select<br/>
                        radio: $radio<br/>
                        checkbox: $checkbox<br/>
                        Email: $email<br/>
                        Message: $message";

            $headers  = 'MIME-Version: 1.0' . "\r\n";
            $headers .= 'Content-type: text/html; charset=utf-8' . "\r\n";
            $headers .= 'From: '.$email . "\r\n";
            $mailed = (mail($to, $subject, $message, $headers));

            if( isset($_REQUEST['ajax']))$response = ($mailed) ? "1" :
            "0"; else $response = ($mailed) ? "<h2>Success!</h2>" :
            "<h2>Error! There was a problem with sending.</h2>";
            echo $response;
         }

      } else {
         echo "Form data error!";
      }

      ob_flush();
      die();
   }
?>

HTML Form:

<?php
               $token = md5(uniqid(rand(), TRUE));
               $_SESSION['token'] = $token;
            ?>

            <!--Contact Form-->
            <form id="contactForm" name="contactForm" action="contact.php"  method="post">
               <input name="token" type="hidden" value="<?php echo $token; ?>">
               <input name="ajax" type="hidden" value="1">

               <div class="name">
                  <p>Your Name</p>
                  <input name="name" class="required" autocomplete="off">
               </div>

               <div class="email-address">
                  <p>Email Address</p>
                  <input name="email" class="required email" autocomplete="off">
               </div>

               <div class="message">
                  <p>Message</p>
                  <textarea name="message" rows="5" class="required min3"></textarea>
               </div>

               <div class="number">
                  <p>Phone Number</p>
                  <input name="number" class="number" autocomplete="off">
               </div>

               <div class="date">
                  <p>Date <small>(dd/mm/yyyy)</small></p>
                  <input name="date" class="required date calendar" autocomplete="off">
               </div>

               <div class="dropdown">
                  <select name="select" class="required">
                     <option value="">Select</option>
                     <option value="DropdownA">DropdownA</option>
                     <option value="DropdownB">DropdownB</option>
                  </select>
               </div>

               <div class="radio">
                  <p>Radios:</p>
                  <label><input name="radio" type="radio" value="male" class="required">Male</label>
                  <label><input name="radio" type="radio" value="female" class="required">Female</label>
               </div>

               <div class="checkbox">
                  <p>Checkboxs:</p>
                  <label><input name="checkbox" type="checkbox" value="OptionA" class="required">Option A</label>
                  <label><input name="checkbox" type="checkbox" value="OptionB" class="required">Option B</label>
               </div>

               <div>
                  <p></p>
                  <input name="" class="required number spamcheck">
               </div>

               <button id="submit" type="submit">Send</button>
            </form>

Answer 1

You do need to check if variables are set, before using them. Otherwise your script will raise errors for undefined variables. Eg You each time will try to check if $_SESSION['token'] != $_POST['token'] but it will give you errors, because there's no form submitted (or however the request is sent) with token name, that's why you do need to check it before that.

Anyway, for multiple isset() you can use a comma separator

if(isset($var, $var2, $var3...))

instead of

if(isset($var) && isset($var2)...))

Also,, if you session token is not initialized too (completely new request to the page), and no request is send to it, your if() statement will return false, thus triggering the mail() function. So, in you particular case it's more than necessary to have a check before using them in mail form.

Answer 2

Yes. They are important. Lots of ways to make the process easier though. You might want to look at a simple framework like Symfony (the forms component can be used independently of the whole framework).

Be aware that you'll probably get a massive amount of spam with that form. Add a captcha like reCaptcha .

Answer 3

Yes, the validation is important but you can simplify your code. I would use an array to define the required fields. It's easy to maintain and much less code.

$requiredFields = array('name', 'email', 'message', 'number');
$valid = true;

foreach ($requiredFields as $field) {
    if (!isset($_REQUEST[$field])) {
        $valid = false;
        break;
    }
}

if ($valid) {
    // Do the stuff
} else {
    echo "Form data error!";
}

If you want to check if the current field actually contains something add empty() to the condition:

if (!isset($_REQUEST[$field]) || empty($_REQUEST[$field])) {

I think the second part where you assign the post values to separate variables is actually unnecessary in this case.