Learn PHP Tutorial logo Learn PHP Tutorial
A linocut relief print in deep forest green and warm cream tones, showing abstract interlocking geometric shapes that suggest data flowing through structured pathways

Validate Form with PHP – Freetuts

Server-side form validation techniques to keep your applications secure and reliable.

Client-side JavaScript validation is convenient, but it cannot be trusted alone — users can disable JavaScript or bypass it entirely. Server-side validation with PHP is essential for real security, ensuring that every piece of data reaching your application has been checked on the server before processing.

1. Useful PHP Validation Functions

Below is a collection of practical validation functions you can use in your PHP projects. Each function checks a specific type of input and returns a boolean result.

  • Checking for empty values — use empty() or compare against an empty string.
  • Validating email format — filter_var($email, FILTER_VALIDATE_EMAIL).
  • Validating integers — filter_var($value, FILTER_VALIDATE_INT).
  • Checking string length — strlen() with minimum and maximum bounds.
  • Sanitizing input — htmlspecialchars() and strip_tags() to prevent XSS.

2. Validating a Form with PHP

The validation process can be broken into two clear stages: checking the data, then displaying errors alongside the submitted values so users can correct them.

Stage 1: Checking the Data

When the form is submitted via POST, loop through each field and apply the appropriate validation rule. Collect any error messages into an array for later display. For example:

$errors = [];
if (empty($_POST['name'])) {
    $errors['name'] = 'Name is required.';
}
if (!filter_var($_POST['email'], FILTER_VALIDATE_EMAIL)) {
    $errors['email'] = 'A valid email is required.';
}

Stage 2: Displaying Errors and Data

After validation, if the $errors array is not empty, re-render the form. Show each error message next to its corresponding field, and repopulate the fields with the previously submitted values using htmlspecialchars() for safety. If no errors exist, proceed with processing the data — such as saving to a database or sending an email.

3. Final Thoughts

Server-side validation is not optional — it is a fundamental layer of defense. Combine it with client-side checks for a smoother user experience, but always rely on PHP validation as the authoritative gatekeeper for your application's data integrity.