Every form I touch looks innocent at first: a few text fields, a submit button, maybe a checkbox. Then the bug reports arrive—mysterious blank emails, phone numbers with letters, links that crash downstream systems, or worse, a payload that turns your contact form into a spam cannon. Form validation is the layer that stops messy inputs before they hit your database or your mailer, and it’s still one of the most underestimated pieces of web engineering.
I’m going to walk you through a practical, production-ready approach to PHP form validation. You’ll see how I validate empty fields, strings, numbers, emails, lengths, URLs, and button clicks. I’ll show a complete runnable form and a server-side validator, then map common mistakes to fixes. I’ll also explain where client-side checks help, where they hurt, and how modern tooling in 2026 changes the workflow. If you want code you can paste into a project today—and advice that won’t bite you later—this is for you.
Validation as a safety layer, not a checkbox
When I review a PHP codebase, I treat validation as a safety layer, not a requirement to pass a linter. A form can look fine in the browser but still accept malicious or malformed data. You should assume users can bypass HTML validation, modify requests, or send data directly via scripts. That’s why every meaningful check belongs on the server.
Here’s the model I use:
- Normalize: trim and sanitize raw inputs
- Validate: verify type, pattern, and rules
- Report: return specific, friendly errors
- Persist: only when validation succeeds
This model keeps your controller clean and your data pipeline predictable. It also reduces the “hidden state” bugs you get when you mix validation logic into database writes.
Empty field validation (required inputs)
Empty field checks are the gatekeeper of every form. I always run them first because the rest of your logic will either fail or produce confusing errors without a basic presence check.
<?php
// validation.php
function input_data(string $value): string {
// Basic normalization: trim whitespace and normalize line endings
$value = trim($value);
$value = str_replace(["\r\n", "\r"], "\n", $value);
return $value;
}
$errors = [];
if (empty($POST["username"])) {
$errors["user_name"] = "User name is required";
} else {
$userName = inputdata($POST["user_name"]);
}
I keep empty checks explicit rather than mixing them with regex rules. That way, you can show a clear “required” message instead of “invalid pattern,” which users often misunderstand.
String validation with clear intent
String validation is more than “letters only.” If you’re collecting a username, you likely want specific characters and a predictable length. If you’re collecting a full name, you probably want spaces and hyphens. Validation should express intent.
Here’s a tight, readable validator for a username:
<?php
$userName = inputdata($POST["user_name"] ?? "");
// Allow letters, numbers, and underscores only
if ($userName !== "" && !pregmatch(‘/^[a-zA-Z0-9]+$/‘, $userName)) {
$errors["user_name"] = "Only letters, numbers, and underscores are allowed";
}
If I’m validating a display name, I widen the rules. Simple example:
<?php
$displayName = inputdata($POST["display_name"] ?? "");
// Letters, spaces, hyphens, and apostrophes; 2+ characters
if ($displayName !== "" && !preg_match("/^[a-zA-Z\s\-‘]{2,}$/", $displayName)) {
$errors["display_name"] = "Please enter a valid display name";
}
That small change communicates intent and reduces false errors. I’m not building a regex arms race, just encoding reasonable expectations for the field.
Number validation without surprises
Numbers are deceptively tricky. When I say “number,” do I mean whole numbers, decimal values, or formatted strings? For ages and counts, I usually want whole numbers. For amounts, I want decimals with a limited precision. Clarity matters.
Whole number (e.g., age):
<?php
$ageRaw = inputdata($POST["age"] ?? "");
if ($ageRaw !== "" && !preg_match(‘/^[0-9]+$/‘, $ageRaw)) {
$errors["age"] = "Age must contain digits only";
} else if ($ageRaw !== "") {
$age = (int) $ageRaw;
if ($age 120) {
$errors["age"] = "Age must be between 13 and 120";
}
}
Decimal amount (e.g., donation):
<?php
$amountRaw = inputdata($POST["donation_amount"] ?? "");
// Allow 2 decimal places, reject negatives
if ($amountRaw !== "" && !preg_match(‘/^(\d+)(\.\d{1,2})?$/‘, $amountRaw)) {
$errors["donation_amount"] = "Please enter a valid amount";
}
I always validate the raw input before casting. Casting first can hide invalid values, and you’ll lose the chance to show a meaningful error.
Email validation: usable and realistic
Email validation is one of those fields where over‑strict validation hurts more than it helps. I avoid complicated custom regex unless I have a very specific business rule. PHP has reliable built‑ins, and I default to them.
<?php
$email = inputdata($POST["email"] ?? "");
if ($email !== "" && !filtervar($email, FILTERVALIDATE_EMAIL)) {
$errors["email"] = "Please enter a valid email address";
}
I only add a regex layer when I need to restrict to a domain or format. For example, allowing only company email:
<?php
if ($email !== "" && !preg_match(‘/@example\.com$/‘, $email)) {
$errors["email"] = "Please use your company email";
}
That approach keeps validation meaningful instead of punitive. You should almost never block valid but uncommon emails unless the business rule demands it.
String length validation for real‑world fields
Length checks are essential for security and UX. They prevent database errors, reduce storage abuse, and keep inputs readable. I always define min and max lengths, even for optional fields.
<?php
$phone = inputdata($POST["phone"] ?? "");
// Expect exactly 10 digits for a US local number
if ($phone !== "") {
if (!preg_match(‘/^[0-9]{10}$/‘, $phone)) {
$errors["phone"] = "Please enter a 10‑digit phone number";
}
}
For a message field, I avoid strict regex and use length bounds:
<?php
$message = inputdata($POST["message"] ?? "");
$min = 20;
$max = 1000;
if ($message !== "") {
$len = strlen($message);
if ($len $max) {
$errors["message"] = "Message must be between $min and $max characters";
}
}
In my experience, length checks make forms feel more reliable because users get immediate guidance and developers avoid truncation bugs.
URL validation that doesn’t fight the web
URLs come in many valid shapes, and strict regex is a trap. I use filtervar with FILTERVALIDATE_URL and then add business rules if needed.
<?php
$website = inputdata($POST["website"] ?? "");
if ($website !== "" && !filtervar($website, FILTERVALIDATE_URL)) {
$errors["website"] = "Please enter a valid URL";
}
If you want to enforce HTTPS:
<?php
if ($website !== "" && !strstartswith($website, "https://")) {
$errors["website"] = "Please use a secure https:// URL";
}
I’m careful not to reject common patterns like https://sub.domain.co.uk/path. Regex often gets those wrong, and it’s not worth the false negatives.
Button click validation and intent checking
A common mistake is assuming a form submission always comes from the correct button. If you have multiple submit buttons (login vs register), you should check which one fired.
<?php
if (isset($_POST["login"])) {
$action = "login";
} else if (isset($_POST["register"])) {
$action = "register";
} else {
$action = "unknown";
}
This small check prevents unintended behaviors, especially when using the same endpoint for multiple actions.
A complete, runnable PHP form validation example
Below is a full example with a form and server‑side validation. You can drop these files into a folder and run them with PHP’s built‑in server. I’ve kept the logic readable and added a few comments only where the intent isn’t obvious.
index.php
<?php
require_once "validation.php";
?>
PHP Form Validation
Simple Registration Form
Fields marked * are required
Thanks! Your form was submitted.
<input type="text" name="username" value="<?php echo htmlspecialchars($old["username"] ?? ""); ?>">
<input type="text" name="displayname" value="<?php echo htmlspecialchars($old["displayname"] ?? ""); ?>">
<input type="text" name="email" value="">
<input type="text" name="age" value="">
<input type="text" name="phone" value="">
<input type="text" name="website" value="">
validation.php
<?php
$errors = [];
$old = [];
$isValid = false;
function input_data(string $value): string {
$value = trim($value);
$value = str_replace(["\r\n", "\r"], "\n", $value);
return $value;
}
if ($SERVER["REQUESTMETHOD"] === "POST") {
// Capture old values for redisplay
foreach ($_POST as $key => $value) {
$old[$key] = is_string($value) ? $value : "";
}
// Button intent
if (isset($_POST["login"])) {
$intent = "login";
} else if (isset($_POST["register"])) {
$intent = "register";
} else {
$errors[] = "Unknown action";
}
// Required: username
if (empty($POST["username"])) {
$errors[] = "User name is required";
} else {
$userName = inputdata($POST["user_name"]);
if (!pregmatch(‘/^[a-zA-Z0-9]+$/‘, $userName)) {
$errors[] = "User name allows letters, numbers, and underscores only";
}
}
// Optional: display name
if (!empty($POST["displayname"])) {
$displayName = inputdata($POST["display_name"]);
if (!preg_match("/^[a-zA-Z\s\-‘]{2,}$/", $displayName)) {
$errors[] = "Display name should be at least 2 characters";
}
}
// Required: email
if (empty($_POST["email"])) {
$errors[] = "Email is required";
} else {
$email = inputdata($POST["email"]);
if (!filtervar($email, FILTERVALIDATE_EMAIL)) {
$errors[] = "Please enter a valid email address";
}
}
// Required: age
if (empty($_POST["age"])) {
$errors[] = "Age is required";
} else {
$ageRaw = inputdata($POST["age"]);
if (!preg_match(‘/^[0-9]+$/‘, $ageRaw)) {
$errors[] = "Age must contain digits only";
} else {
$age = (int) $ageRaw;
if ($age 120) {
$errors[] = "Age must be between 13 and 120";
}
}
}
// Optional: phone
if (!empty($_POST["phone"])) {
$phone = inputdata($POST["phone"]);
if (!preg_match(‘/^[0-9]{10}$/‘, $phone)) {
$errors[] = "Phone number should be 10 digits";
}
}
// Optional: website
if (!empty($_POST["website"])) {
$website = inputdata($POST["website"]);
if (!filtervar($website, FILTERVALIDATE_URL)) {
$errors[] = "Please enter a valid URL";
}
}
// Optional: message length
if (!empty($_POST["message"])) {
$message = inputdata($POST["message"]);
$len = strlen($message);
if ($len 1000) {
$errors[] = "About You must be between 20 and 1000 characters";
}
}
// If no errors, safe to proceed
if (empty($errors)) {
$isValid = true;
// Here you would insert into database or trigger other workflows
}
}
style.css
body {
font-family: "Gill Sans", "Gill Sans MT", Calibri, "Trebuchet MS", sans-serif;
background: #f7f7f7;
display: flex;
justify-content: center;
padding: 40px;
}
.container {
width: 420px;
background: white;
padding: 24px;
border-radius: 10px;
box-shadow: 0 4px 12px rgba(0,0,0,0.1);
}
.title {
font-size: 22px;
font-weight: 600;
margin-bottom: 8px;
}
.note {
display: block;
color: #666;
margin-bottom: 16px;
}
label {
display: block;
margin-top: 12px;
margin-bottom: 4px;
}
input, textarea {
width: 100%;
padding: 8px;
border-radius: 8px;
border: 1px solid #ccc;
}
textarea {
height: 90px;
resize: vertical;
}
.button-row {
display: flex;
gap: 10px;
margin-top: 16px;
}
button {
background: #111;
color: white;
border: none;
padding: 10px 14px;
border-radius: 6px;
cursor: pointer;
}
.error-box {
background: #ffecec;
color: #b30000;
padding: 10px;
border-radius: 8px;
margin-bottom: 12px;
}
.success-box {
background: #e9ffe9;
color: #1b5e20;
padding: 10px;
border-radius: 8px;
margin-bottom: 12px;
}
You can run this locally with:
php -S localhost:8000
Then open http://localhost:8000 in your browser.
Traditional vs modern validation workflows
I still see a lot of “classic” patterns in PHP apps that make validation noisy or hard to test. Here’s how I compare the older approach to what I use today in 2026:
Modern approach (2026)
—
Validation isolated in a dedicated file or service
Built‑in validators first, regex only when needed
Specific, field‑level feedback
Unit tests for each field and rule## Input normalization: the quiet work that saves you later
I’ve learned that most validation failures come from inconsistent input rather than truly bad data. Normalization is the underrated step that makes validation stable and predictable. I focus on four simple moves:
- Trim whitespace
- Normalize line endings
- Convert weird spaces to regular spaces
- Collapse repeated whitespace where it makes sense
Here’s a slightly stronger normalization helper I often use:
<?php
function normalize_string(string $value): string {
$value = trim($value);
$value = str_replace(["\r\n", "\r"], "\n", $value);
$value = preg_replace(‘/\s+/‘, ‘ ‘, $value);
return $value ?? "";
}
I keep normalization separate from validation so it doesn’t hide problems. I want to trim, not transform a bad email into a “valid” one. The goal is to normalize formatting noise, not to rewrite user intent.
Field-level error reporting: better UX, fewer support tickets
Users aren’t wrong when they say a form “doesn’t work.” Often we just aren’t telling them what went wrong. I prefer field‑level errors because they reduce friction, and they’re easier to fix in the UI later.
Instead of pushing all errors into a flat array, I use a keyed error map:
<?php
$errors = [];
if ($email === "") {
$errors["email"] = "Email is required";
} else if (!filtervar($email, FILTERVALIDATE_EMAIL)) {
$errors["email"] = "Please enter a valid email address";
}
This lets the front‑end highlight the exact field that needs attention. If you later add client‑side validation, your error map is already structured to consume.
Sanitization vs validation: don’t mix them up
I see htmlspecialchars() used as a “validator” a lot. That’s not validation. Sanitization protects output contexts. Validation ensures the data is correct before you persist it.
Here’s how I separate concerns:
- Validation: Is the email format valid? Is the age in range?
- Sanitization: Is it safe to display in HTML or store for a SQL query?
Example flow:
<?php
$email = inputdata($POST["email"] ?? "");
if (!filtervar($email, FILTERVALIDATE_EMAIL)) {
$errors["email"] = "Please enter a valid email address";
}
// Later, when outputting
echo htmlspecialchars($email, ENT_QUOTES, ‘UTF-8‘);
If you mix those steps, you’ll either reject valid data or accept invalid data in a “clean” wrapper. Neither is good.
Edge cases you should expect (and how I handle them)
Real traffic means weird inputs. These aren’t theoretical; I see them all the time:
- Empty strings with spaces only
- Multi‑byte characters in names
- Phone numbers with parentheses or +country codes
- Emails with plus addressing (name+tag@domain)
- URLs without scheme (
example.com) - Age fields with leading zeros (
0019)
Here’s how I handle these without over‑engineering:
1) Spaces only
<?php
if (trim($raw) === "") {
$errors[$field] = "This field is required";
}
2) Names with non‑ASCII letters
If you’re targeting global users, ASCII‑only regex may be too strict. I usually accept a broader set and focus on length and harmful characters instead of alphabet purity. A simple shift is to allow letters from any language:
<?php
if ($name !== "" && !preg_match(‘/^[\p{L}\s\-\‘]{2,}$/u‘, $name)) {
$errors["display_name"] = "Please enter a valid display name";
}
3) Phone numbers with formatting
If you need US‑only numbers, you can normalize by stripping non‑digits and then check length:
<?php
$phoneRaw = inputdata($POST["phone"] ?? "");
$digits = preg_replace(‘/\D+/‘, ‘‘, $phoneRaw);
if ($digits !== "" && strlen($digits) !== 10) {
$errors["phone"] = "Phone number should be 10 digits";
}
4) URLs without scheme
If the business rule allows it, you can normalize by adding https:// before validation:
<?php
$website = inputdata($POST["website"] ?? "");
if ($website !== "" && !preg_match(‘/^https?:\/\//i‘, $website)) {
$website = "https://" . $website;
}
if ($website !== "" && !filtervar($website, FILTERVALIDATE_URL)) {
$errors["website"] = "Please enter a valid URL";
}
I make these choices explicit because they’re business rules disguised as validation. You should pick the most helpful behavior for your audience and document it.
Validation that protects your database schema
The fastest way to break a database is to accept data that doesn’t match its constraints. I align validation rules with database constraints to avoid those 3 a.m. “why did this insert fail?” nights.
If your database column is VARCHAR(60) for user_name, your validator should enforce a max of 60 characters. If your age column is TINYINT, your validator should cap values well below overflow.
A small pattern I like:
<?php
$rules = [
"user_name" => ["min" => 3, "max" => 60],
"display_name" => ["min" => 2, "max" => 100],
"message" => ["min" => 20, "max" => 1000],
];
Then I use those rules in both validation and UI hints. Consistency avoids drift.
Required, optional, and conditionally required fields
Not every field is required, but many are required only in certain contexts. Common cases:
- A company name is required only if “Business” is selected.
- A shipping address is required only if “Ship to me” is checked.
- A password is required only when registering, not when updating profile.
A clean way to manage this is to compute requirements based on intent:
<?php
$intent = isset($_POST["register"]) ? "register" : "login";
$requiresPassword = $intent === "register";
if ($requiresPassword && empty($_POST["password"])) {
$errors["password"] = "Password is required for registration";
}
This keeps your rules aligned with business logic, not hardcoded assumptions.
Patterns for reusable validators
If you build more than one form, you’ll want reuse. I keep validators in a simple utility file so I can test and reuse them without framework overhead.
A compact approach:
<?php
function is_required(string $value): bool {
return trim($value) !== "";
}
function is_username(string $value): bool {
return pregmatch(‘/^[a-zA-Z0-9]{3,60}$/‘, $value) === 1;
}
function is_email(string $value): bool {
return filtervar($value, FILTERVALIDATE_EMAIL) !== false;
}
function is_url(string $value): bool {
return filtervar($value, FILTERVALIDATE_URL) !== false;
}
I avoid abstracting too early. When the rules stabilize, then I modularize. The simplest functions are often the most reliable.
Security realities: validation is not enough
Validation reduces risk, but it doesn’t make your app secure. You still need to defend your output and your data layer. Here’s my minimal checklist:
- Always escape output (
htmlspecialchars) when rendering user content - Always use prepared statements for database writes
- Rate‑limit form submissions if they trigger emails or costly workflows
- Add CSRF protection for state‑changing POST requests
Validation should work alongside these defenses, not replace them.
Common pitfalls I see in production
These are mistakes that show up in real projects. Each one is avoidable with small changes:
1) Validating after inserting
I’ve seen form handlers that insert data first and validate later. That’s backwards. Validate, then persist. Otherwise you risk partial writes and corrupted data.
2) Casting before validating
Casting turns invalid values into “valid” defaults. A string like “12abc” becomes 12. Validate raw input first.
3) Using regex for URLs and emails
I’ve never seen a regex for email or URL that is both strict and correct. Prefer built‑ins unless you have a narrow business rule.
4) Returning a generic “Invalid input” message
It’s user‑hostile and increases drop‑off. Specific messages reduce support tickets and increase successful submissions.
5) Forgetting to keep old values
Users hate retyping. Always keep old values on validation failure unless there’s a security reason not to.
Performance considerations (without premature optimization)
Validation is usually cheap, but it can become expensive when you stack heavy regexes on large inputs. In high‑traffic systems, the difference between a simple filter and a complex pattern adds up.
My rule of thumb:
- Use built‑ins first; they’re fast and optimized
- Keep regex simple and anchored (
^and$) to reduce backtracking - Avoid validating huge fields (like long text) with complex regex
- Short‑circuit checks where possible
If you have a message field with a 1000‑character max, check length before regex. That small order change saves CPU time when abuse spikes. I don’t chase microseconds, but I do avoid unnecessary work.
Validation vs verification: don’t confuse them
Validation checks if the format is correct. Verification checks if the data is true. For example:
- Email validation:
[email protected]looks correct - Email verification: the user actually owns the inbox
I use validation on the server, then verification in workflows like email confirmation or phone OTP. Keeping these steps separate makes your system more secure and your UX clearer.
A deeper example: reusable validation with error maps
If you want a more structured approach without pulling in a framework, here’s a clean pattern that scales:
<?php
function validate_registration(array $input): array {
$errors = [];
$data = [];
$data["username"] = inputdata($input["user_name"] ?? "");
if ($data["user_name"] === "") {
$errors["user_name"] = "User name is required";
} else if (!pregmatch(‘/^[a-zA-Z0-9]{3,60}$/‘, $data["user_name"])) {
$errors["user_name"] = "User name must be 3–60 characters and use letters, numbers, underscores";
}
$data["email"] = input_data($input["email"] ?? "");
if ($data["email"] === "") {
$errors["email"] = "Email is required";
} else if (!filtervar($data["email"], FILTERVALIDATE_EMAIL)) {
$errors["email"] = "Please enter a valid email address";
}
$data["age"] = input_data($input["age"] ?? "");
if ($data["age"] === "") {
$errors["age"] = "Age is required";
} else if (!preg_match(‘/^[0-9]+$/‘, $data["age"])) {
$errors["age"] = "Age must contain digits only";
} else {
$age = (int) $data["age"];
if ($age 120) {
$errors["age"] = "Age must be between 13 and 120";
}
}
return ["data" => $data, "errors" => $errors];
}
Then in your request handler:
<?php
$result = validateregistration($POST);
$errors = $result["errors"];
$clean = $result["data"];
if (empty($errors)) {
// Use $clean values safely
}
This pattern gives you a single place to update rules and makes unit testing straightforward.
Testing validation without friction
Validation is the easiest part of your app to unit test. You’re just turning inputs into errors. I write tests for edge cases and business rules so I don’t accidentally loosen rules during refactors.
Example cases I test:
- Required fields missing
- Username with invalid characters
- Email with plus addressing
- Age out of range
- Message length boundary (exact min and max)
Even a basic test suite here pays off quickly because validation rules are where regressions hide.
Client‑side validation: helpful, but never authoritative
Client‑side validation is great for speed and UX, but it’s not secure. I use it to provide immediate feedback, not to replace server checks.
I tend to mirror the same rules in JavaScript and PHP, but I treat the server as the source of truth. If the rules drift, the server wins.
That means:
- Use
required,type=email, andminlengthfor UX - Keep JS validation simple and consistent
- Always validate again on the server
You’ll catch more issues and reduce user frustration.
Handling file uploads safely
If your form allows file uploads, validation gets more complex. You can’t trust file extensions or client‑side MIME types.
My minimum checks:
- Verify file size against a max
- Verify MIME type using
finfo_file - Rename files on upload to prevent collisions
- Store outside the web root if possible
A small example of MIME checking:
<?php
$finfo = new finfo(FILEINFOMIMETYPE);
$mime = $finfo->file($FILES["avatar"]["tmpname"]);
$allowed = ["image/jpeg", "image/png"];
if (!in_array($mime, $allowed, true)) {
$errors["avatar"] = "Please upload a JPG or PNG image";
}
Uploads are a security boundary. Treat them seriously.
Internationalization and localization concerns
If your app is global, validation rules should respect local formats. Phone numbers, postal codes, and names differ widely.
My approach:
- Avoid over‑strict rules for names
- Store phone numbers in normalized E.164 format when possible
- Use locale‑specific validation only when the user chooses a country
For phone numbers, I often store raw input plus a normalized version so I can support multiple formats without breaking the UI.
Alternative approaches: frameworks and libraries
If you’re using a framework like Laravel or Symfony, you already have powerful validation tools. I still like to understand the basics, because it helps when debugging or writing custom rules.
For example, Laravel’s validation rules are expressive and testable, but the concepts are the same: normalize, validate, report, persist. The core principles remain identical even when the syntax changes.
Modern tooling in 2026: what changed and what didn’t
Here’s how the workflow evolved for me over the past few years:
- I use AI assistants to draft regex or edge cases faster
- I rely more on shared validation utilities across services
- I log validation errors in a structured way for analytics
- I still do server‑side validation first, always
AI can accelerate the boring parts, but it can also introduce overly strict rules. I still review validation logic manually because the stakes are high and the edge cases are subtle.
Monitoring validation failures in production
Validation isn’t a one‑time event. If you instrument it, you’ll learn how real users behave. I like to track:
- Which fields fail most often
- What error messages are most common
- Which inputs are frequently missing
This tells you where your form is confusing or too strict. I’ve made small wording changes that reduced errors dramatically without loosening any rules.
Common “when NOT to validate” scenarios
Yes, there are times when you should accept messy input:
- Free‑form messages where users need flexibility
- Search forms where strict rules reduce useful results
- Marketing signup forms where a loose entry is better than a drop‑off
In these cases, I validate for safety (length, basic sanity) but avoid tight formatting rules. It’s about conversion and intent, not perfect data.
A practical checklist I use before shipping
I run through this list before a form goes live:
- Required fields have clear errors
- Optional fields allow empty values
- Email and URL use built‑in validation
- Lengths match database constraints
- Error messages are specific and human
- Server validates everything, even if JS also validates
- Old values repopulate on error
- Logs record validation failures without exposing sensitive data
It’s a simple list, but it catches 90% of issues.
Expansion: separating validation from business actions
One common source of bugs is mixing validation with side effects (sending email, inserting records). I separate those stages:
<?php
$result = validateregistration($POST);
$errors = $result["errors"];
$clean = $result["data"];
if (empty($errors)) {
// Side effects only here
// sendWelcomeEmail($clean["email"]);
// saveToDatabase($clean);
}
This makes validation testable and keeps side effects predictable.
Another full example: a compact validator class
If you prefer a more structured approach without a full framework, here’s a tiny validator class you can copy and expand:
<?php
class Validator {
private array $errors = [];
public function required(string $field, string $value, string $message): void {
if (trim($value) === "") {
$this->errors[$field] = $message;
}
}
public function pattern(string $field, string $value, string $pattern, string $message): void {
if ($value !== "" && preg_match($pattern, $value) !== 1) {
$this->errors[$field] = $message;
}
}
public function email(string $field, string $value, string $message): void {
if ($value !== "" && !filtervar($value, FILTERVALIDATE_EMAIL)) {
$this->errors[$field] = $message;
}
}
public function range(string $field, int $value, int $min, int $max, string $message): void {
if ($value $max) {
$this->errors[$field] = $message;
}
}
public function errors(): array {
return $this->errors;
}
}
Usage:
<?php
$v = new Validator();
$userName = inputdata($POST["user_name"] ?? "");
$email = inputdata($POST["email"] ?? "");
$v->required("user_name", $userName, "User name is required");
$v->pattern("username", $userName, ‘/^[a-zA-Z0-9]{3,60}$/‘, "User name must be 3–60 characters");
$v->required("email", $email, "Email is required");
$v->email("email", $email, "Please enter a valid email address");
$errors = $v->errors();
It’s minimal, but it helps keep logic clean, especially as forms grow.
Production considerations: rate limits and abuse prevention
Validation stops malformed input, but it doesn’t stop abuse. If a form triggers emails or writes to a queue, add rate limits or CAPTCHAs as needed. I typically:
- Rate‑limit by IP and by email
- Add hidden honeypot fields to trap bots
- Throttle submissions in a short window
Validation is one layer; abuse prevention is another.
Putting it all together: a mental model you can trust
If you take nothing else from this guide, take the model:
- Normalize your input
- Validate with clear, intentional rules
- Report precise, field‑level errors
- Persist only when validation passes
When I follow this model, my PHP forms behave consistently across environments, and bug reports drop. It’s not flashy, but it’s reliable—and reliability is what forms need.
Expansion Strategy
Add new sections or deepen existing ones with:
- Deeper code examples: More complete, real-world implementations
- Edge cases: What breaks and how to handle it
- Practical scenarios: When to use vs when NOT to use
- Performance considerations: Before/after comparisons (use ranges, not exact numbers)
- Common pitfalls: Mistakes developers make and how to avoid them
- Alternative approaches: Different ways to solve the same problem
If Relevant to Topic
- Modern tooling and AI-assisted workflows (for infrastructure/framework topics)
- Comparison tables for Traditional vs Modern approaches
- Production considerations: deployment, monitoring, scaling
If you want, I can tailor this to a specific use case—contact forms, e‑commerce checkout, registration flows, or admin panels—and add targeted validation rules and examples.
