php/mysql form validation

midnite · Feb 22, 2007

Hi, i'm a complete newbie to php and have been relying on premade codes so far to create what i need. I've tried all these sort of templates for form validation but none seem to work, example.

What I want to add to my form is some sort of required field validation for certain fields, please note that some of these fields are option boxes, plain text entry boxes and option list boxes. What I ideally want is some sort of message that either comes up on the same page or as a pop-up box saying which boxes need t be filled in before the form is submitted.

Any help with this would be greatly appreciated, as i'm completely stuck on this.

I'm making a data submission form using the following code to send data from the form to the sql database:

<?php
if ($post == "yes") {

//THEN WE ARE ADDING A NEW RECORD SUBMITTED FROM THE FORM
//REPLACE THE FIELD CONTENTS SO THEY DON'T MESS UP YOUR QUERY

/-- SECTION: 9994SQL --/
$sql = "INSERT INTO term (
id,
contract_hours,
FTE,
salary_band,
staff_type,
TPF,
TNPF,
RPF,
RNPF,
RPF_R11,
RPF_R12,
RNPF_R21,
RPF_R13,
RNPF_R22,
RPF_R14,
RNPF_R23,
RNPF_R24,
O,
O1,
ST,
SR,
SO,
SG
$addl_insert_crit ) VALUES ( '$id',
'$contract_hours',
'$FTE',
'$salary_band',
'$staff_type',
'$TPF',
'$TNPF',
'$RPF',
'$RNPF',
'$RPF_R11',
'$RPF_R12',
'$RNPF_R21',
'$RPF_R13',
'$RNPF_R22',
'$RPF_R14',
'$RNPF_R23',
'$RNPF_R24',
'$O',
'$O1',
'$ST',
'$SR',
'$SO',
'$SG'
$addl_insert_values )";
if ($sql_debug_mode==1) { echo "<BR>SQL: $sql<BR>"; }
$result = mysql_query($sql,db());
if ($result == 1) {
echo "Record Inserted";
} else {
echo "Error inserting record (9994SQL)";
}
//** END INSERT SQL **

} //END IF POST = YES FOR ADDING NEW RECORDS

if (!$post) {
//THEN WE ARE ENTERING A NEW RECORD
//** BEGIN ADD NEW FORM**
/-- SECTION: 9994FORM --/
?>[/COLOR]

and this at the bottom of the page after all the html form layout, etc:

<?php
} //END if post=""

//** END ADD NEW ENTRY FORM**

/*---------------------------------------------------------------
FUNCTION: db()
DESCRIPTION: CREATES DB CONNECTION OBJECT FOR KNEBEL.NET
PHP CODE GENERATOR CODE.
INPUTS: NONE
RETURNS: DATABASE CONNECTION OBJECT
GLOBAL VARIABLES: NONE
FUNCTIONS CALLED: NONE
CALLED BY:
AUTHOR: KNEBEL
MODIFICATIONS:
MM/DD/YY - CREATED FUNCTION (KNEBEL.NET)
NOTES:

----------------------------------------------------------------*/
function db()
{
$dbuser = "";
$dbserver = "";
$dbpass = "";
$dbname = "";

	//CONNECTION STRING
	$db_conn = mysql_connect($dbserver, $dbuser, $dbpass)
	or die ("UNABLE TO CONNECT TO DATABASE");
	mysql_select_db($dbname)
	or die ("UNABLE TO SELECT DATABASE");
	return $db_conn;
}//end function db

?>[/COLOR]

NogDog · Feb 22, 2007

In the future, please use the

 bbcode tags around your code, like this:
[code=php]
<?php
if ($post == "yes") {

//THEN WE ARE ADDING A NEW RECORD SUBMITTED FROM THE FORM
//REPLACE THE FIELD CONTENTS SO THEY DON'T MESS UP YOUR QUERY

/*-- SECTION: 9994SQL --*/
	$sql = "INSERT INTO term (
id,
contract_hours,
FTE,
salary_band,
staff_type,
TPF,
TNPF,
RPF,
RNPF,
RPF_R11,
RPF_R12,
RNPF_R21,
RPF_R13,
RNPF_R22,
RPF_R14,
RNPF_R23,
RNPF_R24,
O,
O1,
ST,
SR,
SO,
SG
 $addl_insert_crit ) VALUES ( '$id',
'$contract_hours',
'$FTE',
'$salary_band',
'$staff_type',
'$TPF',
'$TNPF',
'$RPF',
'$RNPF',
'$RPF_R11',
'$RPF_R12',
'$RNPF_R21',
'$RPF_R13',
'$RNPF_R22',
'$RPF_R14',
'$RNPF_R23',
'$RNPF_R24',
'$O',
'$O1',
'$ST',
'$SR',
'$SO',
'$SG'
 $addl_insert_values )";
	if ($sql_debug_mode==1) { echo "<BR>SQL: $sql<BR>"; }
	$result = mysql_query($sql,db());
	if ($result == 1) {
	echo "Record Inserted";
	} else {
	echo "Error inserting record (9994SQL)";
	}
//***** END INSERT SQL *****


} //END IF POST = YES FOR ADDING NEW RECORDS

if (!$post) {
//THEN WE ARE ENTERING A NEW RECORD
//***** BEGIN ADD NEW FORM*****
	/*-- SECTION: 9994FORM --*/
	?>

NogDog · Feb 22, 2007

A couple quick comments:

Unless there's additional code at the beginning of the script you're not showing us, it looks like the script is depending on [man]register_globals[/man] being activated, which is a deprecated behavior and not a good thing to depend on.
There is no use of [man]mysql_real_escape_string[/man] or other methods to prevent SQL injection attacs through your form.

As far as form validation, at it's simplest, when you enter the if($post == "yes") { block, you would add one or more additional if statements to check for values in required fields. It could be something like:

<?php
if($post == "yes")
{
  $error = "";
  if(trim($contract_hours) === "")
  {
    $error .= "You must enter a value for Contract Hourse.<br>";
  }
  if(trim($FTE) === "")
  {
    $error .= "You must enter a value for FTE.<br>";
  }
  // etc. for all required fields
  if($error == "")  // no errors found
  {
    // do the form processing here
  }
}
if($post != "yes" or !empty($error))
{
  // output the form here, including this where desired:
  if(!empty($error))
  {
    echo "<p style='color: red'>$error</p>\n";
  }
}

midnite · Feb 22, 2007

Hi, thanks for replying, in regards to the validation example code you posted, where do i put that? should it look something like this?:

<?php
if($post == "yes")
{
  $error = "";
  if(trim($contract_hours) === "")
  {
    $error .= "You must enter a value for Contract Hourse.<br>";
  }
  if(trim($FTE) === "")
  {
    $error .= "You must enter a value for FTE.<br>";
  }
  // etc. for all required fields
  if($error == "")  // no errors found
  {
    // do the form processing here
  }
}
if($post != "yes" or !empty($error))
{
  // output the form here, including this where desired:
  if(!empty($error))
  {
    echo "<p style='color: red'>$error</p>\n";
  }
} 

if ($post == "yes") {

//THEN WE ARE ADDING A NEW RECORD SUBMITTED FROM THE FORM
//REPLACE THE FIELD CONTENTS SO THEY DON'T MESS UP YOUR QUERY

/*-- SECTION: 9994SQL --*/
$sql = "INSERT INTO term (
id,
contract_hours,
FTE,
salary_band,
staff_type,
TPF,
TNPF,
RPF,
RNPF,
RPF_R11,
RPF_R12,
RNPF_R21,
RPF_R13,
RNPF_R22,
RPF_R14,
RNPF_R23,
RNPF_R24,
O,
O1,
ST,
SR,
SO,
SG
$addl_insert_crit ) VALUES ( '$id',
'$contract_hours',
'$FTE',
'$salary_band',
'$staff_type',
'$TPF',
'$TNPF',
'$RPF',
'$RNPF',
'$RPF_R11',
'$RPF_R12',
'$RNPF_R21',
'$RPF_R13',
'$RNPF_R22',
'$RPF_R14',
'$RNPF_R23',
'$RNPF_R24',
'$O',
'$O1',
'$ST',
'$SR',
'$SO',
'$SG'
$addl_insert_values )";
if ($sql_debug_mode==1) { echo "<BR>SQL: $sql<BR>"; }
$result = mysql_query($sql,db());
if ($result == 1) {
echo "Record Inserted";
} else {
echo "Error inserting record (9994SQL)";
}
//***** END INSERT SQL *****


} //END IF POST = YES FOR ADDING NEW RECORDS

if (!$post) {
//THEN WE ARE ENTERING A NEW RECORD
//***** BEGIN ADD NEW FORM*****
/*-- SECTION: 9994FORM --*/
?>

if possible do you have any complete example code for me to refer to?

php/mysql form validation

Mmidnite

NogDog

NogDog

Mmidnite