[web] Question about validating forms

Never, ever, trust the data received from a form. Always perform server-side verification of user data. And, of course, Under no circumstances should you insert user-provided input into a database without heavy prior server-side checking. If form data is invalid, re-display the form with error messages.

Submitted elements are in either $_POST or $_GET superglobals depending on the submission method of your form.

I guess I'll just use javascript to check null values and do the rest of the checking with PHP.

to abort submitting your form, return false when you find an error.

verifiyForm(){   //found an error   alert(...)   return false   //found no error   return true}

[input type='submit' onsubmit='verifyForm()']
or
[input type='submit' onsubmit='return verifyForm()']
I don't remember

And like ToohrVyk said "Always perform server-side verification of user data."

To be honest, I've given up checking on the client side. The checks are performed only once on the server side, and if anything is incorrect, the form is displayed again with detailed error messages.

Is there any point in using javascript for validating forms (which would eventually be put to a databases)?<br><br>Why wouldn't you trust something from the client side? I mean if you have a javascript with the HTML form you could tell a user to input values which aren't null, less than 10 characters etc. It wouldn't submit the form data to the server unless it satisfies the javascript code. Why is this not sufficient?<br><br>Also cheers Iarus for the 'return false' tip, it does seem to be working.

I provide client-side checks to help out the user of the form. It's annoying to send the user to a new page (and have them wait for all the server-side checks) only to tell them that there was a problem. Using client-side checks you can tell them about any problems before they submit the form.

You should NEVER trust any data that the user gives you because it is very possible - and easy - to submit data that bypasses your checks. This could be as simple as disabling javascript and it could be as complicated as crafting a POST message and sending it to the appropriate URL having not even looked at your form. No data coming from the user should be assumed to be valid, correct, or safe.

I use both client and server side checks because I'm that anal about an end user being foolish enough to try to bypass my security measures.

Don't forget to trim() your data too (this is much easier to do in PHP, can be accomplished with a little bit of code in JS).

Like others said, don't trust user input. Assume nothing.

There are plenty of ways around javascript / client-side error checking. Especially if the user has it turned off, and then you run an accessability risk if your form doesn't work without javascript turned on.<br><br>Rule #1: There is no security on the internet.<br><br>You should use PHP to do the error checking, if an error is found do a "include_once" function calling the page back. In the html of the code you can assign values to each form like so:<br><br>value="<?php echo $varName; ?>"<br><br>Which will only be apparent when a user has submitted the form once and an error has occured.

Quote:

Original post by markadrake value="<?=htmlspecialchars(stripcslashes($_POST["varname"])); ?>"

[wink]

After implementing the proper validation on the server, you could be nice to some users by using Web Forms 2.0 - just write stuff like <input type="email" name="addr" required> and a suitable browser will automatically show handy error messages to the user if they enter an invalid email address or if they don't enter anything at all, and you don't have to do any non-trivial work and it'll work fine (as a plain text box with server-side error reporting) in old browsers.

It's only implemented (and only incompletely) in Opera 9 so far, but it's very likely to be in future versions of Firefox too, so it can make some of your users happier by giving them more immediate feedback on their errors [smile]