form Validation

nllewellyn

I am trying to write a guest book for my site. I have the basic form working ok, but I would like to make sure that the required form fields are filled in.

I have added this bit of code:

<?php
// submitted form details
isset ($name, $email, $country, $comment);

if (!isset($name, $email, $country, $comment));
{
echo "All Form fields must be completed before submitting";
echo "<a href = "\""/guestbook/guestbook.php""\"> Click here to go Back </a>";
}
?>

BUT it displays the error message no matter if the fields are completed or not!

Help..... I'm sure its a silly mistake but I just cant see whats wrong... doh

laserlight

hmm... I was about to suggest that isset() only takes one variable to test, but on second thought I think that isnt the issue, with isset() being a language construct.

More likely you need to use say, $_POST['name'], i.e. register_globals is now set to off by default.

devinemke

i'll be damned, never knew isset() could take multiple arguments but indeed it can.

$var1 = 'one';
$var2 = 'two';

if (isset($var1, $var2)) { // returns TRUE }

both variable arguments have to be set for isset() to return true.

$var1 = 'one';
// $var2 = 'two';

if (isset($var1, $var2)) { // returns FALSE }

sorry to get off topic. yes i think laserlight is right. check your register_globals state in php.ini.

tommynanda

Using PHP to check validation might be costly in the sense of bandwidth. You might want to use Javascript on client side... some like...

<head>
<script language="Javascript">
function testval(){
	var usrname = document.getElementById("name").value;
	var usremail = document.getElementById("email").value;
	var count = document.getElementById("country").value;
	var comments = document.getElementById("comment").value;
	if(usrname == "" || usremail == "" || count == "" ||  comment == "")
	{
		alert("Please Fill All The Compulsory Fields \n\nThank You");
		return false;
	}
	else
	{
		return true;
	}
}
</script>
</head>
<body>
<form onSubmit="return testval();">
<!-- FIll ur text boxes here with names name,email,country,comment -->
<input type=submit name=submit>
</form>

Hope this helps

TommYNandA

laserlight

Using PHP to check validation might be costly in the sense of bandwidth

On the other hand, using Javascript alone might be costly in the sense of damage due to malicious code injection.

tommynanda

sense of damage due to malicious code injection.

Agree with you, never thought abt it that way. There are Bad guys like me every where 😃

devinemke

although it's more work, i have always done both client-side and server-side form validation (just in case the client does not support my client-side validation code).

nllewellyn

Thanks for your reply

Originally posted by laserlight
More likely you need to use say, $_POST['name'], i.e. register_globals is now set to off by default.

Can you explain what this does different?

My html form posts the variables to formhandler.php. I thought that I could use the variables as $name within my formhandler.php file

is $_POST['name'] an array?

sorry if this sounds dumb but I'm unable to get my head around the register_globals explination in my PHP book.

Thanks

devinemke

the register_globals directive automagically creates globals variables out all of the indexes in the GET/POST/COOKIE/SESSION arrays. that is to say if you goto...

http://www.domain.com/index.php?name=nllewellyn

...with register_globals ON you will have a variable in "index.php" called $name that is set to "nllewellyn". this practice is depreciated since PHP 4.2.0 as it makes it very easy to write insecure code. PHP creates pre-defined superglobal arrays out of all of the GET/POST/COOKIE/SESSION to access the data coming in from those mechanisms: $GET, $POST, $COOKIE, $SESSION. it is recommended that you turn OFF register_globals and use those superglobals instead. for more info read this.

nllewellyn

Ahhhh haaa Thanks 🙂

I ran phpinfo and discovered that register_globals is set to On with my provider.

I changed my code to reflect my new wisdom:

// submitted form details
isset ($_POST['name']);

if (!isset($_POST['name']))
{
echo "All Form fields must be completed before submitting";

}

regardless if I have entered something into the name field or not on my form, it still displays the error message.

Is there something else wrong with my code/ logic?

appreciate the help