PHP Form Validation

Form validation is like a teacher checking that a homework sheet is filled in correctly before accepting it. PHP checks that required fields are not empty and that things like emails look right.

In this page:

Validating Emails
Validating Integers
Checking Input Length
Custom Format Validation
Collecting Validation Errors

Syntax

php

if (filter_var($value, FILTER_VALIDATE_EMAIL)) { }
if (filter_var($value, FILTER_VALIDATE_INT)) { }
if (empty($value)) { }
if (strlen($value) > max_length) { }

Validating Emails

Server-side validation checks that submitted form data actually meets your requirements — correct format, required fields present, values within range — and must always be done even if you also validate in JavaScript, since client-side checks can be bypassed entirely.

Example: Validating Emails

php

<?php
// Declare `$email`, set to "[email protected]"
$email = "[email protected]";
// Check whether `filter_var($email, FILTER_VALIDATE_EMAIL)`
if (filter_var($email, FILTER_VALIDATE_EMAIL)) {
    // Print "Valid email" to the output
    echo "Valid email";
// Otherwise, run this branch
} else {
    // Print "Invalid email" to the output
    echo "Invalid email";
}
?>

Validating Integers

empty() and isset() are the first line of defense for required fields, letting you reject a submission immediately if a mandatory field like an email address is missing or blank.

Example: Validating Integers

php

<?php
// Set `$_POST['email']` to ""
$_POST['email'] = "";
// Check whether `empty($_POST['email'])`
if (empty($_POST['email'])) {
    // Print "Email is required" to the output
    echo "Email is required";
}
?>

Checking Input Length

filter_var($value, FILTER_VALIDATE_EMAIL) and similar filter_var() calls provide built-in validation for common formats like emails and URLs, saving you from writing fragile validation logic by hand.

Example: Checking Input Length

php

<?php
// Declare `$email`, set to "[email protected]"
$email = "[email protected]";
// Print a detailed dump (with types) of `filter_var($email, FILTER_VALIDATE_EMAIL)`
var_dump(filter_var($email, FILTER_VALIDATE_EMAIL));
?>

Custom Format Validation

Numeric fields need explicit checks like is_numeric() plus range checks, since PHP's loose typing means a string like 5abc can behave unpredictably in arithmetic if you don't validate its shape first.

Example: Custom Format Validation

php

<?php
// Declare `$age`, set to "25abc"
$age = "25abc";
// Check whether `is_numeric($age) && $age > 0`
if (is_numeric($age) && $age > 0) {
    // Print "Valid" to the output
    echo "Valid";
// Otherwise, run this branch
} else {
    // Print "Invalid numeric input" to the output
    echo "Invalid numeric input";
}
?>

Collecting Validation Errors

Good validation gives specific, actionable feedback (e.g. 'Password must be at least 8 characters') rather than a single generic 'invalid input' message, which frustrates users trying to figure out what actually went wrong.

Example: Collecting Validation Errors

php

<?php
// Declare `$password`, set to "abc"
$password = "abc";
// Check whether `strlen($password) < 8`
if (strlen($password) < 8) {
    // Print "Password must be at least 8 characters" to the output
    echo "Password must be at least 8 characters";
}
?>

Chapter Quiz — Complete all 8 topics to unlock

0/8 topics done

Complete these topics first:

← Previous Lesson PHP Form Handling Next Lesson → PHP Form Sanitization