Question

I am trying this code as part of form processing:

<?php

if(isset($_POST['senderEmail'])) 
    {
     try
     {

     require '_php/_security/validation.php';  //SEE BELOW

     $rules = array(               
            'senderEmail' => 'validEmail',
            'emailTextbox' => 'validTextbox',
        );

        $validation = new Validation();

        if ($validation->validate($_POST, $rules) == TRUE) {  
            require("_php/database/dbProcessing.php"); //Form Proccessing for database inclusion
        }

        else {  
          foreach($validation->emailErrors as $error){
            $emailErrors[] = $error;
            $_SESSION['$emailErrors'] = $emailErrors;

            header('Location:indexmobile.php#emailErrors'); 
            die('ABORT!');
        }
    }

    }
   catch (PDOException $e)
    {

      $error = 'Error adding elements to database: ' . $e->getMessage();
      echo "Error: " . $error;
      exit();
    }

exit();
}
?>

The validation.php where I do my validation has this:

<?php

class Validation {

public $errors = array();
public function validate($data, $rules) {
    $valid = TRUE;
    foreach ($rules as $fieldname => $rule) {
        $callbacks = explode('|', $rule);
        foreach ($callbacks as $callback) {
            $value = isset($data[$fieldname]) ? $data[$fieldname] : NULL;
            if ($this->$callback($value, $fieldname) == FALSE) $valid = FALSE;
        }
    }
   return $valid;
}

public function validEmail($value, $fieldname) {
    $valid = !empty($value); 
    if ($valid  == FALSE) {
        $this->emailErrors[] = "The $fieldname is required";
        return $valid;
    } else {
        $valid = filter_var($value, FILTER_VALIDATE_EMAIL);
        if ($valid  == FALSE) $this->emailErrors[] = "The $fieldname needs to be a valid email";
        return $valid;
    }
}

public function validTextbox($value, $fieldname) {
    $valid = !empty($value);   
    if ($valid  == FALSE) {
        $this->emailErrors[] = "The $fieldname is required";
        return $valid;
    } else {
        $whitelist = '/^[a-zA-Z0-9 ,\.\+\\n;:!_\-@]+$/';  
        $textarea = strip_tags($value);
        $textarea = mysql_real_escape_string($textarea);  
        $valid = preg_match($whitelist, $textarea);
        if ($valid  == FALSE) $this->errors[] = "The $fieldname contains invalid characters";
        return $valid; 
     }
  }

}

Upon using this, Im have issues with the redirect (I think). It seems further that Im having errors in validation. My questions are thus:

  1. Am I doing the header redirect correctly? I've read that " header() must be called before any actual output is sent,.." So is this the reason why this redirect is incorrect? how to make a redirect if i need to show/send something to the redirected page?
  2. function validTextbox always ends up an error that the field is empty. Why so?
  3. Is my entire process of form validation a good way of validating form fields (which i learned from watching an online tutorial)? What is a better way?
  4. Is there something wrong with error reporting in this case?

Thank you for those who replies. I am new to PHP and trying my best to learn the language.

Was it helpful?

Solution

1 - There are several ways to pass on a message to the page you are redirecting to. One is through $_GET like this

$message="Some message for the next page.";
$message=urlencode($message);
header("Location:page.php?message=".$message);

then on page.php

if(!empty($_GET['message']))
{
$_GET['message'];
}

similarly you can also use the session (less secure)

$_SESSION['message']='some other message';

then on page.php

if (!empty($_SESSION['message']))
{
echo $_SESSION['message'];
unset($_SESSION['message']);
}

2 - I would have to see what you are passing to your validate function. You should do a var_dump of $_POST and add that to your question.

3 - It depends on your criteria. If you are just checking for emptiness its overkill. I don't know what text you need / consider valid, but a regex is a reasonable way of enforcing validation.

4 - See #2.

Licensed under: CC-BY-SA with attribution
Not affiliated with StackOverflow
scroll top