Validating and Securing Form Inputs

Welcome to the next lesson! In this lesson, you’ll learn how to validate and secure user inputs to ensure your forms are accurate and protected from malicious attacks. Let’s dive in!

Why Validate and Secure Inputs?

Validating and securing form inputs is crucial to:

• Ensure data accuracy and usability.
• Protect against security threats like SQL injection and XSS attacks.

Key Point: Always validate and sanitize user inputs before processing or storing them.

Validating Inputs

Use PHP’s built-in functions to validate common inputs:

• filter_var(): Validates email, URLs, and integers.
• preg_match(): Validates inputs against regular expressions.

Example: Validating an email address:

<?php
  if ($_SERVER["REQUEST_METHOD"] == "POST") {
    $email = $_POST["email"];
    if (filter_var($email, FILTER_VALIDATE_EMAIL)) {
      echo "Valid email: $email";
    } else {
      echo "Invalid email address.";
    }
  }
?>

Sanitizing Inputs

Sanitize inputs to remove unwanted characters or harmful code. Example:

Tip: Use filter_var() with appropriate filters for different types of data.

<?php
  if ($_SERVER["REQUEST_METHOD"] == "POST") {
    $name = filter_var($_POST["name"], FILTER_SANITIZE_STRING);
    echo "Sanitized Name: $name";
  }
?>

Preventing Cross-Site Scripting (XSS)

Escape special characters to prevent XSS attacks. Use:

• htmlspecialchars(): Converts special characters to HTML entities.

Example:

Tip: Always escape user inputs before displaying them in the browser.

<?php
  if ($_SERVER["REQUEST_METHOD"] == "POST") {
    $comment = htmlspecialchars($_POST["comment"]);
    echo "Comment: $comment";
  }
?>

Preventing SQL Injection

SQL injection occurs when malicious code is inserted into your SQL queries. Use prepared statements to prevent it. Example:

Key Point: Always use prepared statements for database interactions.

<?php
  $pdo = new PDO("mysql:host=localhost;dbname=testdb", "root", "");
  $stmt = $pdo->prepare("SELECT * FROM users WHERE username = :username");
  $stmt->execute(["username" => $_POST["username"]]);
  $user = $stmt->fetch();
?>

Common Validation Patterns

Here are some common patterns:

• Validating a phone number: preg_match('/^\d{10}$/', $phone)
• Validating a password: Check length and complexity.

Example: Validating a strong password:

<?php
  if ($_SERVER["REQUEST_METHOD"] == "POST") {
    $password = $_POST["password"];
    if (strlen($password) >= 8 && preg_match('/[A-Z]/', $password)) {
      echo "Strong password!";
    } else {
      echo "Password must be at least 8 characters long and include an uppercase letter.";
    }
  }
?>

Securing File Uploads

For forms handling file uploads:

• Check the file type and size.
• Store files in a secure directory outside the web root.

Example:

<?php
  if ($_FILES["file"]["size"] < 500000 && in_array($_FILES["file"]["type"], ["image/jpeg", "image/png"])) {
    move_uploaded_file($_FILES["file"]["tmp_name"], "/secure/location/" . $_FILES["file"]["name"]);
    echo "File uploaded successfully!";
  } else {
    echo "Invalid file.";
  }
?>

Great Job!

Congratulations! You’ve learned how to validate and secure form inputs to ensure your web applications are safe and reliable. In the next lesson, we’ll explore handling file uploads in PHP. Let’s keep coding!