how can I ensure that require form fields are filled??

[uddin]

hi
how can I ensure that the required fields are filled with valid data?

requesting help

thanks

[karinne]

What server-side language are you using?!

[masonbarge]

Yes uddin, this needs to go in another forum -- PHP, ASP, maybe even javascript?

[uddin]

I am using MySQL n PHP

[ScottR]

Well, you can approach this a number of ways. My first question would be do you know javascript and are you validating client side first? If not I would suggest doing that, it's quite common to validate on your users machine before heading over to PHP validation on the server.

That doesn't mean do not validate at the server. It's a real good idea to catch any potential errors before hand.

I'm going to assume you have no knowledge of regular expressions. So you can access your form element in javascript using names like this:

Code: Select all

document.form name.element name.value

Substituting the name of your form and the name of your element with the ones on your page. Now that you have the value of that field you can test it to make sure it falls within what you have allowed, and if not display your error message.

So, say you want to make sure the field is filled in you could use:

Code: Select all

if (document.formName.fieldName.value == "" ) {
            alert ("That field must be filled out")
            }

Once you've validated the information, send it to the server and check it again with your php. Staying with the name theory use

PHP: Select all

$_POST[fieldName] 

So it may look like this:

PHP: Select all

if ($_POST[fieldName] == "") {
header("Location: form.html");
       exit;
} 

That will stop the script and send the user back to the form.

Find Javascript info: http://www.w3schools.com/js/default.asp
Find PHP info : http://www.php.net/

Man, now that I think about it. That may be TMI and I probably didn't explain it very well. Hope I helped instead of making it worse.

Good Luck

[masonbarge]

Okay, first a word of advice about posting a question. It's a lot easier to answer if you post the related code, both html and php.

Let's suppose you have a form asking for a person's first name and you are going to handle the form on a different page called (www.yoursite.xxx/formhandle.php). Your form will look something like this, only you'll need to format it a bit for presentation.

Code: Select all

<form id="stats" method="post" action="formhandle.php">
                        First Name:
                       <input name="f_name" type="text" class="whatever" size="8" maxlength="20"
 /><input type="image" src="./images/submit_button.gif"
 name="Submit"  value="Submit" /><input type="hidden" name="submitted"
 value="yes" /></form>

I've used an image for the submit button with no rollover effect.

Now on page "formhandle php" there are several ways to ensure that the first name text box has something in it. One basic way is

PHP: Select all

if (isset($_POST['Submit']))  {
    if (isset($_POST['f_name']) {
         $firstname=$_POST['f_name'];
    } else {
        error_alert("Please go back and enter your first name");
        exit();
    }
(lots more stuff goes in here)
} else {
[do whatever you want to happen if the person gets to the page without
 having submitted the form]
} 

There are two "if" clauses. The first requires that the user has hit the submit button to get here.

The second "if" clause answers your question. it requires that there is something in the form input "f_name". The global variable we chose with our method -- which is $_POST[] because we set (method="post"), and specifically will be named $_POST['f_name'] -- must past the test isset(). (If you don't know the specific meaning of isset() just google "php isset" to get to the php manual or a number of other explanations.) You can use other functions, even the simple "if($_POST['f_name'])".

If the form has been filled in correctly, you will now have a lovely variable, $firstname, that you can use however you want. You can just pop it into an sql query written in php, like

PHP: Select all

$query="SELECT * FROM database WHERE first_name='$firstname'"; 

In this case I have used a user-created function "error_alert()", which would have to be created or included on the page, as the error message. So if there is something in the form input named "f_name" it will be set as the variable $firstname; if there is not, the user will get an error message.

You didn't ask about security, but it is absolutely essential that you validate the entry in PHP if you have an open MySQL connection on the page, as you obviously will. The most secure way to do this is to use a regular expression. I use PERL regex and the minimum test for a name would be something like

PHP: Select all

if ((isset($_POST['f_name'])) &&
 (preg_match('/^[a-zA_Z]{3,20}$/', $_POST['f_name'])))  {
         $firstname=$_POST['f_name'];
    } else {
        error_alert("Please go back and enter your first name. Use only
 the letters A-Z and a-z. The name must be between 3 and 20 characters long.");
        exit();
    } 

That's the basics of what I do. You can use the built-in error function die() instead of writing your own function -- it's very commonly used.

Notice that you must validate in PHP. You can also validate in javascript as a convenience to the user, because it is capable of printing a warning without loading a new page, but it provides almost zero site security (because javascript can be disabled so easily). Regex provides a high level of security, and if I am not mistaken completely closes this avenue of attack for hackers.

I'm sorry to be the bringer of bad news, but you really need to understand the basics of some flavor of regular expressions before you expose a php/mysql form to the public. The bad news is that regex is confusing and rather difficult to learn at first. The good news is that you probably only need a few basics and Jan Goyvaerts has a wonderful free tutorial online at
http://www.regular-expressions.info/php.html

I suspect from your question that you might want a bit more study on handling php forms. If so, my best recommendation would be a book by Larry Ullman called "PHP and MYSQL for Dynamic Websites".

Finally, just in case you are curious, I'll cut and paste an error_alert() definition from my files. I would put this in a separate file and include it high on the handler page:

PHP: Select all

function error_alert  ($message, $rules=NULL)  {
    echo '<style type="text/css"> .box_bottom {margin-left: 121px;} p.aws
 {padding: 0 0 10px 40px;  width: 400px; text-indent: 0; font-size: 1em;
 line-height: 1.1em; }
</style>';
    echo '<div id="fcontent"><div class="abox"><div class="boxhead">
            <img src="images/alert.gif" width="509" height="53" alt="model
 airplane Alert logo"/></div>
            <div class="box_auto">';
        echo "<p class=\"aws\">$message</p>";
        echo "<p class=\"aws\">$rules</p>";
        echo '</div>';
?>
        
        <!-- box_auto --></div><!-- box -->
        <img src="./images/box_bg_bottom.gif" width="509" height="7"
 class="box_bottom" alt="model airplane box bottom graphic" /><br
 class="sp5" />
<?php
        echo '<div class = "clear"></div></div>';
    include_once('./footer_interactive.inc');
    exit();
}
?>

This function has a lot of formatting in it, but notice that it ends with the exit() function, so that the script will stop running if there is an error. In the examples above we put exit() in the php; only one of these is necessary. It's just basic housekeeping to stop the script when you hit an error.

As long as I'm at it, a note about function definitions: There are two parameters in the definition. The first is required and will be the basic error message. There is an optional second parameter created by the syntax "$rules=". In the example, the error message can include a second paragraph of text, an image, whatever. You could put a default message in this parameter by substituting whatever you want for NULL, which would print or echo something automatically unless you set a different second parameter.

(I realize this isn't anything special btw, especially the bloated css, but it makes a pretty alert page.)

I've spent too much time here and can't proofread this post -- please feel free to point out any error.