how to show php validations error on page

Question

I have a form and all the validations, now I want to show the error messages in front of the text field not in the url. How do I do this?

Here is my PHP code:

<?php 

if ((isset($_POST['submit']))){

    $email = strip_tags($_POST['email']);
    $fullname = strip_tags($_POST['fullname']);
    $username = strip_tags($_POST['username']);
    $password = strip_tags($_POST['password']);



    $fullname_valid = $email_valid = $username_valid = $password_valid = false;



if(!empty($fullname)){

  if (strlen($fullname) > 2 && strlen($fullname)<=30) {
    if (!preg_match('/[^a-zA-Z\s]/', $fullname)) {
      $fullname_valid = true;

      # code...
    }else {$fmsg .="fullname can contain only alphabets <br>";}
 }else{$fmsg1 .="fullname must be 2 to 30 char long <br>";}
  }else{$fmsg2 .="fullname can not be blank <br>";}


if (!empty($email)) {
  if (filter_var($email , FILTER_VALIDATE_EMAIL)) {

     $query2 = "SELECT email FROM users WHERE email = '$email'";
      $fire2 = mysqli_query($con,$query2) or die("can not fire  query".mysqli_error($con));
      if (mysqli_num_rows($fire2)>0) {
      $msg .=$email."is already taken please try another one<br> ";
      }else{
        $email_valid=true;
      }
    # code...
  }else{$msg .=$email."is an invalid email address <br> ";}
  # code...
}else{$msg .="email can not be blank <br>";}



if(!empty($username)){

  if (strlen($username) > 4 && strlen($username)<=15) {
    if (!preg_match('/[^a-zA-Z\d_.]/', $username)) {


      $query = "SELECT username FROM users WHERE username = '$username'";
      $fire = mysqli_query($con,$query) or die("can not fire  query".mysqli_error($con));


        if(mysqli_num_rows($fire)> 0){
          $umsg ='<p style="color:#cc0000;">username already taken</p>';
        }else{
          $username_valid = true;
        }
        # code...

      # code...
    }else {$msg.= "username can contain only alphabets <br>";}
 }else{$msg.= "username must be 4 to 15 char long <br>";}
  }else{$msg.="username can not be blank <br>";}

if (!empty($password)) {
  if (strlen($password) >=5 && strlen($password) <= 15 ) {
    $password_valid = true;
    $password = md5($password);

    # code...
  }else{$msg .= $password."password must be between 5 to 15 character long<br>";}
  # code...
}else{$msg .= "password can not be blank <br>";}

if ($fullname_valid && $email_valid && $password_valid && $username_valid) {
  $query = "INSERT INTO users(fullname,email,username,password,avatar_path) VALUES('$fullname','$email','$username','$password','avatar.jpg')";
  $fire = mysqli_query($con,$query) or die ("can not insert data into database".mysqli_error($con));
if ($fire){ 


 header("Location: dashboard.php");}



}else{
  header("Location: createaccount.php?msg=".$msg);
}

}


  ?>

and this is my html code:

 <div class="container">
      <form  name="signup" id="signup" method="POST">
         <h2>sign up</h2>
      <div class="form-input">
      <input name="email" type="email" name="email" id="email" placeholder="enter email" required="email is required">



      </div>
      <input name="mobile" type="number" id="mobile" placeholder="enter mobile number" required="mobile is required">
      <span id="message"></span>
      <div class="form-input">
      <input name="fullname" type="full name" id="fullname" name="full name" placeholder="full name" required="what's your fullname">
  </div>
  <div>
    <input name="username" type="username" id="username" name="username" placeholder="username" required="username is required">
  </div>
  <div>
    <input name="password" type="password" id="password" name="password" placeholder="password" required="password is required">
  </div>
      <div>
      <input type="submit" name="submit" id="submit" 
         value="sign up" class="btn btn-primary btn-block">

         <a href="#">forgot password?</a>
         <h3>have an account? <a href="login">log in</a></h3>
      </div>
      </form>

How do I get the error message in front of my text field, and also how do I get the specified error in front of the specified text field? I don't want to use ajax or javascript. I want to do it with PHP. I have tried this but no luck.

<?php if(isset($errorfname)) { echo $errorfname; } ?>

Unless I'm missing something, the only place in your entire code where `$errorfname` shows up is when you attempt to print it :-? — Álvaro González, Oct 10 '18 at 08:32
do _not_ md5 passwords. use password_hash and password_verify! — Jeff, Oct 10 '18 at 08:38

score 2 · Answer 1 · answered Oct 10 '18 at 08:33

2

send msg to get params is not good idea. Use session

$_SESSION['error_msg'] = $msg
header("Location: createaccount.php");

and add get error in php

$errors = '';
if(isset($_SESSION['error_msg'])) { $errors = $_SESSION['error_msg']; } ?>

and in html show $errors

answered Oct 10 '18 at 08:33

Evgeniy Belov

358
1
7

$_SESSION['error_msg'] = $msg header("Location: createaccount.php"); instead header("Location: createaccount.php?msg=".$msg); i don't know where you are display your html. In this code, that display html add $errors = ''; if(isset($_SESSION['error_msg'])) { $errors = $_SESSION['error_msg']; } ?> and in html, where you want show error add =$errors;?> – Evgeniy Belov Oct 10 '18 at 09:51

score 0 · Accepted Answer · answered Oct 10 '18 at 08:50

By looking at your form does not have an action attribute therefore one can concluded that you are submitting the form at the same page as the form PHP_SELF

So if you want to display the error next to the field I would advice that you first declare an empty variables for each text error on top of your page then echo the variables next to each field.

<?php

$emailError    = "";
$fullnameError = "";
$usernameError = "";
$passwordError = "";
$errors        = 0;

if ((isset($_POST['submit']))) {

    $email    = strip_tags($_POST['email']);
    $fullname = strip_tags($_POST['fullname']);
    $username = strip_tags($_POST['username']);
    $password = strip_tags($_POST['password']);



    $fullname_valid = $email_valid = $username_valid = $password_valid = false;



    if (!empty($fullname)) {

        if (strlen($fullname) > 2 && strlen($fullname) <= 30) {
            if (!preg_match('/[^a-zA-Z\s]/', $fullname)) {
                $fullname_valid = true;

                # code...
            } else {
                $fullnameError = "fullname can contain only alphabets <br>";
                $errors++;
            }
        } else {
            $fullnameError = "fullname must be 2 to 30 char long <br>";
            $errors++;
        }
    } else {
        $fullnameError = "fullname can not be blank <br>";
        $errors++;
    }


    if (!empty($email)) {
        if (filter_var($email, FILTER_VALIDATE_EMAIL)) {

            $query2 = "SELECT email FROM users WHERE email = '$email'";
            $fire2 = mysqli_query($con, $query2) or die("can not fire  query" . mysqli_error($con));
            if (mysqli_num_rows($fire2) > 0) {
                $emailError = $email . "is already taken please try another one<br> ";
            } else {
                $email_valid = true;
            }
            # code...
        } else {
            $emailError = $email . "is an invalid email address <br> ";
            $errors++;
        }
        # code...
    } else {
        $emailError = "email can not be blank <br>";
    }


    if (!empty($username)) {

        if (strlen($username) > 4 && strlen($username) <= 15) {
            if (!preg_match('/[^a-zA-Z\d_.]/', $username)) {


                $query = "SELECT username FROM users WHERE username = '$username'";
                $fire = mysqli_query($con, $query) or die("can not fire  query" . mysqli_error($con));


                if (mysqli_num_rows($fire) > 0) {
                    $usernameError = '<p style="color:#cc0000;">username already taken</p>';
                    $errors++;
                } else {
                    $username_valid = true;
                }

            } else {
                $usernameError = "username can contain only alphabets <br>";
                $errors++;
            }
        } else {
            $usernameError = "username must be 4 to 15 char long <br>";
            $errors++;
        }
    } else {
        $usernameError = "username can not be blank <br>";
        $errors++;
    }

    if (!empty($password)) {
        if (strlen($password) >= 5 && strlen($password) <= 15) {
            $password_valid = true;
            $password       = md5($password);

            # code...
        } else {
            $passwordError = $password . "password must be between 5 to 15 character long<br>";
            $errors++;
        }
        # code...
    } else {
        $passwordError = "password can not be blank <br>";
        $errors++;
    }

    //if there's no errors insert into database
    if ($errors <= 0) {
        if ($fullname_valid && $email_valid && $password_valid && $username_valid) {
            $query = "INSERT INTO users(fullname,email,username,password,avatar_path) VALUES('$fullname','$email','$username','$password','avatar.jpg')";
            $fire = mysqli_query($con, $query) or die("can not insert data into database" . mysqli_error($con));
            if ($fire) {


                header("Location: dashboard.php");
            }
        }

    }
}
?>
<div class="container">
<form  name="signup" id="signup" method="POST">
    <h2>sign up</h2>
    <div class="form-input">
        <input name="email" type="email" name="email" id="email" placeholder="enter email" required="email is required">
        <!-- display email error here -->
        <?php echo $emailError?>
    </div>
    <input name="mobile" type="number" id="mobile" placeholder="enter mobile number" required="mobile is required">
    <span id="message"></span>
    <div class="form-input">
        <input name="fullname" type="full name" id="fullname" name="full name" placeholder="full name" required="what's your fullname">
        <?php echo $fullnameError?>
    </div>
    <div>
        <input name="username" type="username" id="username" name="username" placeholder="username" required="username is required">
        <?php echo $usernameError?>
    </div>
    <div>
        <input name="password" type="password" id="password" name="password" placeholder="password" required="password is required">
        <?php echo $passwordError?>
    </div>
    <div>
        <input type="submit" name="submit" id="submit" value="sign up" class="btn btn-primary btn-block">
        <a href="#">forgot password?</a>
        <h3>have an account? <a href="login">log in</a></h3>
    </div>
</form>

NB: I would advice that you look into password_hash() andpassword_verify()to hash your passwords, they provide better security as compared tomd5()` and make sure your database column is atleast 60 characters in length.. I would also advice to look into prepared statements.

The following can help :

How can I prevent SQL injection in PHP? Using PHP 5.5's password_hash and password_verify function

score 0 · Answer 3 · answered Oct 10 '18 at 08:50

I think the best way is include from template in result

if ($fire){
    header("Location: dashboard.php");
}else{
    include("createaccount.php");
}

And in createaccount.php

<div class="container">
    <form  name="signup" id="signup" method="POST">
        <h2>sign up</h2>
        <p class="errors"><?= $msg ?></p>
...

how to show php validations error on page

3 Answers3