使用 php 验证 html 表单

Question

我有一个表单需要在将表单值插入数据库之前使用 php 进行验证。

如果字段为空，它工作得很好，但是当我包含一个代码以确保在名字和姓氏字段中只允许使用字母和空格时，它破坏了验证过程，即当我在其中输入任何字母组合时它显示一条错误消息的字段，说“只需要字母和空格”。

其次，当所有字段为空时，表单会显示相应的错误消息，并且不会将表单提交到数据库。但是，当我在 textarea 字段中输入消息而其他字段为空时，表单会将数据提交到数据库并显示其他空字段的错误消息。

我们将不胜感激任何解决这些问题的帮助。

代码如下：

    <?php
    $fnameErr = $lnameErr = $emailErr = $amountErr = $phoneErr = $genderErr = $messageErr = $categoryErr = $countryErr = "";
     $fname = $lname =  $email = $amount = $phone  =  $gender  = $message = $category = $country = "";
    $ipaddress ="";
    $defaultMessage = "Please type your message here.";

 $formErrors = false;
 if ($_SERVER["REQUEST_METHOD"] == "POST") {

     //for first name
     $name= $_POST["fname"];
     if (empty($_POST["fname"])){
        $fnameErr = "Please, enter your first name";
        $formErrors = true;
    }elseif(!preg_match("/^[a-zA-Z]*&/", $name)){
        $fnameErr = "Only letters and white spaces are allowed in the first name field";
        $formErrors = true;
    }else{
        $fname = $_POST["fname"];
        $formErrors = false;
    }


    //Last Name match
    // for last name
     $name2= $_POST["lname"];
    if (empty($_POST["lname"])){
        $lnameErr = "Please, enter your last name";
        $formErrors = true;
    }elseif(!preg_match("/^[a-zA-Z]*&/", $name2)){
        $lnameErr = "Only letters and white spaces are allowed in the Last name field";
        $formErrors = true;
    }else{
        $lname = $_POST["lname"];
        $formErrors = false;
    }


    // for email format
     $emailf =($_POST["email"]);
    if (empty($_POST["email"]))  {
        $emailErr = "Please, enter your email";
        $formErrors = true;
    }elseif (!filter_var($emailf, FILTER_VALIDATE_EMAIL)) {
        $emailErr = "Invalid email format"; 
        $formErrors = true;
     }else {
        $email = $_POST["email"];
        $formErrors = false;
    }


    //for phone
     if (empty($_POST["phone"])){
         $phoneErr = "Please, enter your phone number";
         $formErrors = true;
     }else{
        $phone = $_POST["phone"];
        $formErrors = false;
    }


     // for amount
    if (!isset($_POST["amount"])) {
        $amountErr = "You must select an amount";
        $formErrors = true;
    }
    else {
        $amount = $_POST["amount"];
        $formErrors = false;
    }

     // for gender
     if (!isset($_POST["gender"])) {
        $genderErr = "You must select your gender";
        $formErrors = true;
    }
    else {
        $gender = $_POST["gender"];
        $formErrors = false;
    }


     // for country
     if (empty($_POST["country"]) || $_POST["country"] == "Country") {
        $countryErr = "Please, select your country";
        $formErrors = true;
    }
    else {
        $country = $_POST["country"];
        $formErrors = false;
    }

      // for category
     if (empty($_POST["category"]) || $_POST["category"] == "Category") {
        $categoryErr = "Please, select a category";
        $formErrors = true;
    } else {
        $category = $_POST["category"];
        $formErrors = false;
    }

     // for message
     if (empty($_POST["message"]) || $_POST["message"] == $defaultMessage){
        $messageErr = "Please type your prayer request";
        $formErrors = true;
    }else{
        $message = $_POST["message"];
        $formErrors = false;
    }

    if (empty($formErrors) ) {
        //connect to database
         require_once("../../includes/connect_to_db.php");

       // set time zone to uk
       $timezone = date_default_timezone_set("Europe/london");


        //setting values 
        $Timestamp = date('Y-m-d h:i:s');
        $fname = $_POST["fname"];
        $lname = $_POST["lname"];
        $email = $_POST["email"];
        $phone = $_POST["phone"];
        $gender = isset($_POST["gender"]) ? $_POST["gender"] : ''; 
        $message = $_POST["message"]; 
        $country = $_POST["country"]; 
        $category = $_POST["category"]; 

        //echo $gender . "value";
        //var_dump(billingDate);
        // var_dump($customer);

        //Escape all string
        $firstname = mysqli_real_escape_string($connection, $fname);
        $lastname = mysqli_real_escape_string($connection, $lname);
        $emailNew = mysqli_real_escape_string($connection, $email);
        $phoneNew = mysqli_real_escape_string($connection, $phone);
        $genderNew = mysqli_real_escape_string($connection, $gender);
        $messageNew = mysqli_real_escape_string($connection, $message);
        $countryNew = mysqli_real_escape_string($connection, $country);
        $categoryNew = mysqli_real_escape_string($connection, $category);

        //querying the database
        $query = "INSERT into counselling ( ";
        $query .= "Timestamp, FirstName, LastName, ";
        $query .= "Email, PhoneNumber, Category, Country, Gender, Message";
        $query .= ")";
        $query .= "VALUES ('{$Timestamp}', '{$firstname}', '{$lastname}', ";
        $query .= "'{$emailNew}', '{$phoneNew}', '{$categoryNew}', '{$countryNew}', '{$genderNew}', '{$messageNew}' ";
        $query .= ")";

        echo $query;

        $result = mysqli_query($connection, $query) ;

        //check for query error
        if($result){
            //query success redirect_to ("somepage.php");
           //redirect_to("confirmation.php");
            echo "Success";
        } else {
             die("Database query failed");
        }

    } // end of if

  } // End of form submission conditional. 
?>

Answer 1

你需要用适当的逻辑重构你的代码。

<?php
$fname = $_POST["fname"];
$lname = $_POST["lname"];

$errors = array();

if(trim($fname) == ''){
    $errors['fname'] = "First name is required";
}


if(trim($lname) == ''){
    $errors['lname'] = "Last name is required";
}

if(count( $errors) > 0){
  //form invalid
}
else{
   //form is valid
}