Form validation: How to give a user specific feedback with PHP?

Question

I have a form with 3 input boxes, 1 radio button, 3 dropdown lists and of course a submit button.

1 dropdown box must be an integer input & 1 must be alphabetic only.

I have currently got very basic validation functionality set up which can:

1) Check that all the require fields have been supplied with some data. 2) Check that one input box is ints only. 3) check that another is letters only.

If any input is left out, I can output an error. What I'm trying to do is determine which fields were left out and give the user a more specific feedback to the right of the relevant field

This is the code so far (it's probably not the most efficient solution):

if (isset($_POST['submit'])){
            $submit = ($_POST['submit']);

            $title = $_POST['title'];
            $duration = $_POST['duration'];
            $director = $_POST['director'];


            /*if (isset($_POST['cert'])){
            echo "cert set: ".$_POST['cert'];
            }*/



            //If any of the (title, duration, director) are empty or if any of the (day, month, year) are unchanged or if the cert isn't set i.e radio button checked
            //Error
            if (empty($title) || empty($duration) || empty($director) || !isset($_POST['cert']) || ($_POST['day'] == "DD") || ($_POST['month'] == "MM") || ($_POST['year'] == "YYYY")){

                    echo "Error";

            } else {

                        //Check if duration entered is an integer
                        if (is_int($duration) && ctype_alpha($director)) {

                                $cert = $_POST['cert'];
                                $day = $_POST['day'];
                                $month = $_POST['month'];
                                $year = $_POST['year'];
                                $day = convertToTwoDigit($day);
                                $month = convertToTwoDigit($month);
                                $year = convertToTwoDigit($year);


                                $date = $year."/".$month."/".$day;


                                echo "<br>Title: ".$title."</br>"."Duration: ".$duration."</br>"."Director: ".$director."</br>"."Cert: ".$cert."</br>Relesed on: ".$date;

                                //Add values into database: 

                                if ($insert = $db->query("
                                INSERT INTO titles (cert, filmtitle, releaseDate, filmDuration, director) VALUES ('$cert', '$title', '$date', '$duration', '$director')
                                ")){
                                    echo "You have added a film";
                                } else {
                                    echo "Error adding";
                                }
                    } else {
                                echo "director or duration error";
                    }
        }


}

What is required to improve the validation to be more specific. Would some sort of array work ?

Answer 1

There are tons of ready-made PHP form validators available, e.g. Easiest Form validation library for PHP?. I recommend researching frameworks like Laravel and Symfony; they are easy to use and reduce a lot of boilerplate like validation, routing, templating, etc.

For the sake of learning (sounds like you aren't that familiar with arrays), a validator would so something like this, but with the functionality neatly encapsulated within a class:

// Required items
$required = array('title'       => array('type'     => 'alpha',
                                         'message'  => 'Title is required and must be alphabetic'), 
                  'duration'    => array('type'     => 'int',
                                         'message'  => 'Duration is required and must be numeric'), 
                  'director'    => array('type'     => 'alpha',
                                         'message'  => 'Director is required and must be alphabetic')); 

$_POST = array('title' => 'Unforgiven', 'duration' => '2 hours', 'director' => 'Clint Eastwood');
// 'duration' will be invalid because it must be an integer but (obviously) contains alpha characters

// Remove empty items
$post = array_filter($_POST);

$invalid = array();

// Loop required items, checking to see that a) they are in the array and b) their values match your criteria
foreach ( $required as $k => $v ) {
    // Element is empty or not set
    if ( !isset($post[$k]) ) {
        $invalid[$k] = $v['message'];
        continue;
    }
    if ( $v['type'] == 'alpha' && preg_match('/[a-zA-Z ]$/i', $post[$k]) ) {
        // Only letters and spaces
        continue;
    } else if ( $v['type'] == 'int' && preg_match('/[0-9]$/', $post[$k]) ) {
        // Only integers
        continue;
    }
    $invalid[$k] = $v['message'];
}

var_dump($invalid);

You would then pass the contents of $invalid back to the file that generates the form, and use the data to output messages to the user.