Registration form Validation in php

Question

Here I have few questions regarding validation

1. The code below works well but is it okay to use so many elseif ?

2. I will also be using client side validation so can I have both server side validation and client side validation code on same page.

    if( $firstname == "" ) { $er='Enter your First name'; } elseif( $lastname == "" ) { $er='Enter your Last name'; } elseif( $firstname == $lastname ) { $er='First name and last name cannot be same'; } elseif( $username == "" ) { $er='Enter your username'; } elseif( $password == "" ) { $er='Enter your password'; } elseif( strlen($password) < 6 ) { $er='Password must be more than 6 characters'; } elseif( $password != $password2 ) { $er='Password and confirm password does not match!'; } elseif( $email != "" && !preg_match( "/^([a-zA-Z0-9])+([a-zA-Z0-9\\._-])*@([a-zA-Z0-9_-])+([a-zA-Z0-9\\._-]+)+$/", $_POST["email"] ) ) { $er='Enter valid email'; } elseif($q->rowCount() > 0) { // $q is statement used to select username from db $er='The username '.$username.' is already taken!'; } elseif($s->rowCount() > 0) { // $s is statement used to select email from db $er='The email '.$email.' is already registered, choose another!'; } else { // some pdo statement to insert data if ($stmt->rowCount() == 1) { header("Location:userarea.php"); } else { echo "error"; } } 

Answer 1

1) Too many if-else statements is a good indication of poor design. You should use a validation class or write your own. A little bit off-topic but this code reminds me the days we had in 1990s :) Why don't you at least use a micro-framework instead of re-inventing the wheel again and again...

2) You can detect if the call is made with ajax or not:

if(!empty($_SERVER['HTTP_X_REQUESTED_WITH']) && strtolower($_SERVER['HTTP_X_REQUESTED_WITH']) == 'xmlhttprequest') {
  ...
}

so in the controller you collect the validation errors in an array and if it's a AJAX request convert it to JSON and do ajax validation (check jquery validator) and if not simply handle the errors as you would w/o ajax. I must warn that this obviously won't be as responsive as pure client side validation but, yeah defining all these validation rules over and over is boring. That's why we use frameworks to ease the pain these days...

Answer 2

try this:

if (empty($_POST["fname"]))
{
    $nameErr = "Your First Name Is Missing";
}
        else
    {
        $name = $_POST['name'];

        if (!preg_match("/^[a-zA-Z a-zA-Z]*$/", $name))
        $nameErr = "Your Name Is Missing";
}


if (empty($_POST["age"]))
     {
    $ageErr = "Your Age Is Missing";
}
        else
    {
        $age = $_POST['age'];

        if (!preg_match("/^[0-9]*$/", $age))
        $nameErr = "Your Age Is Missing";
}

Answer 3

When you are validating so many fields you will need JS or jQuery to validate and not refresh the page because this can be annoying to users that the page keeps reloading with different errors. Best option is to use jQuery Validation.