PHPを使用したhtmlフォームの妥当性確認

Question

フォームの値をデータベースに挿入する前に、phpを使用して検証する必要があるフォームがあります。

フィールドが空白の場合はうまくいきましたが、姓と姓のフィールドに文字と空白を使用できるようにするコードを含めると、検証プロセスが壊れました。つまり、文字の組み合わせフィールドに「文字と空白のみが必要です」というエラーメッセージが表示されました。

第2に、すべてのフィールドが空白の場合、フォームは適切なエラーメッセージを表示し、フォームをデータベースに送信しません。しかし、他のフィールドが空のtextareaフィールドにメッセージを入力すると、フォームはデータベースにデータを送信し、他の空のフィールドのエラーメッセージも表示します。

これらの問題を解決する助けがあれば幸いです。

<?php 
    $fnameErr = $lnameErr = $emailErr = $amountErr = $phoneErr = $genderErr = $messageErr = $categoryErr = $countryErr = ""; 
    $fname = $lname = $email = $amount = $phone = $gender = $message = $category = $country = ""; 
    $ipaddress =""; 
    $defaultMessage = "Please type your message here."; 

$formErrors = false; 
if ($_SERVER["REQUEST_METHOD"] == "POST") { 

    //for first name 
    $name= $_POST["fname"]; 
    if (empty($_POST["fname"])){ 
     $fnameErr = "Please, enter your first name"; 
     $formErrors = true; 
    }elseif(!preg_match("/^[a-zA-Z]*&/", $name)){ 
     $fnameErr = "Only letters and white spaces are allowed in the first name field"; 
     $formErrors = true; 
    }else{ 
     $fname = $_POST["fname"]; 
     $formErrors = false; 
    } 


    //Last Name match 
    // for last name 
    $name2= $_POST["lname"]; 
    if (empty($_POST["lname"])){ 
     $lnameErr = "Please, enter your last name"; 
     $formErrors = true; 
    }elseif(!preg_match("/^[a-zA-Z]*&/", $name2)){ 
     $lnameErr = "Only letters and white spaces are allowed in the Last name field"; 
     $formErrors = true; 
    }else{ 
     $lname = $_POST["lname"]; 
     $formErrors = false; 
    } 


    // for email format 
    $emailf =($_POST["email"]); 
    if (empty($_POST["email"])) { 
     $emailErr = "Please, enter your email"; 
     $formErrors = true; 
    }elseif (!filter_var($emailf, FILTER_VALIDATE_EMAIL)) { 
     $emailErr = "Invalid email format"; 
     $formErrors = true; 
    }else { 
     $email = $_POST["email"]; 
     $formErrors = false; 
    } 


    //for phone 
    if (empty($_POST["phone"])){ 
     $phoneErr = "Please, enter your phone number"; 
     $formErrors = true; 
    }else{ 
     $phone = $_POST["phone"]; 
     $formErrors = false; 
    } 


    // for amount 
    if (!isset($_POST["amount"])) { 
     $amountErr = "You must select an amount"; 
     $formErrors = true; 
    } 
    else { 
     $amount = $_POST["amount"]; 
     $formErrors = false; 
    } 

    // for gender 
    if (!isset($_POST["gender"])) { 
     $genderErr = "You must select your gender"; 
     $formErrors = true; 
    } 
    else { 
     $gender = $_POST["gender"]; 
     $formErrors = false; 
    } 


    // for country 
    if (empty($_POST["country"]) || $_POST["country"] == "Country") { 
     $countryErr = "Please, select your country"; 
     $formErrors = true; 
    } 
    else { 
     $country = $_POST["country"]; 
     $formErrors = false; 
    } 

     // for category 
    if (empty($_POST["category"]) || $_POST["category"] == "Category") { 
     $categoryErr = "Please, select a category"; 
     $formErrors = true; 
    } else { 
     $category = $_POST["category"]; 
     $formErrors = false; 
    } 

    // for message 
    if (empty($_POST["message"]) || $_POST["message"] == $defaultMessage){ 
     $messageErr = "Please type your prayer request"; 
     $formErrors = true; 
    }else{ 
     $message = $_POST["message"]; 
     $formErrors = false; 
    } 

    if (empty($formErrors)) { 
     //connect to database 
     require_once("../../includes/connect_to_db.php"); 

     // set time zone to uk 
     $timezone = date_default_timezone_set("Europe/london"); 


     //setting values 
     $Timestamp = date('Y-m-d h:i:s'); 
     $fname = $_POST["fname"]; 
     $lname = $_POST["lname"]; 
     $email = $_POST["email"]; 
     $phone = $_POST["phone"]; 
     $gender = isset($_POST["gender"]) ? $_POST["gender"] : ''; 
     $message = $_POST["message"]; 
     $country = $_POST["country"]; 
     $category = $_POST["category"]; 

     //echo $gender . "value"; 
     //var_dump(billingDate); 
     // var_dump($customer); 

     //Escape all string 
     $firstname = mysqli_real_escape_string($connection, $fname); 
     $lastname = mysqli_real_escape_string($connection, $lname); 
     $emailNew = mysqli_real_escape_string($connection, $email); 
     $phoneNew = mysqli_real_escape_string($connection, $phone); 
     $genderNew = mysqli_real_escape_string($connection, $gender); 
     $messageNew = mysqli_real_escape_string($connection, $message); 
     $countryNew = mysqli_real_escape_string($connection, $country); 
     $categoryNew = mysqli_real_escape_string($connection, $category); 

     //querying the database 
     $query = "INSERT into counselling ("; 
     $query .= "Timestamp, FirstName, LastName, "; 
     $query .= "Email, PhoneNumber, Category, Country, Gender, Message"; 
     $query .= ")"; 
     $query .= "VALUES ('{$Timestamp}', '{$firstname}', '{$lastname}', "; 
     $query .= "'{$emailNew}', '{$phoneNew}', '{$categoryNew}', '{$countryNew}', '{$genderNew}', '{$messageNew}' "; 
     $query .= ")"; 

     echo $query; 

     $result = mysqli_query($connection, $query) ; 

     //check for query error 
     if($result){ 
      //query success redirect_to ("somepage.php"); 
      //redirect_to("confirmation.php"); 
      echo "Success"; 
     } else { 
      die("Database query failed"); 
     } 

    } // end of if 

    } // End of form submission conditional. 
?> 

Answer 1

適切なロジックを使用してコードをリファクタリングするというあなたの必要性：ここで

はコードです。

<?php 
$fname = $_POST["fname"]; 
$lname = $_POST["lname"]; 

$errors = array(); 

if(trim($fname) == ''){ 
    $errors['fname'] = "First name is required"; 
} 


if(trim($lname) == ''){ 
    $errors['lname'] = "Last name is required"; 
} 

if(count($errors) > 0){ 
    //form invalid 
} 
else{ 
    //form is valid 
}