PHP Form Validation (Full Code)

Why validate input

Any data that comes from a user's form cannot be trusted — it might be empty, wrong, or even harmful. Validation checks that the input is correct, and sanitization cleans it so it is safe to use and display. Doing both protects your data and your website.

Trim and sanitize

First clean the raw input — remove stray spaces and make it safe to display.

<?php
  $name = trim($_POST["name"] ?? "");
  $name = htmlspecialchars($name);
  echo $name;
?>

trim removes accidental spaces. htmlspecialchars turns characters like < into safe text, which stops users injecting HTML or scripts (an XSS attack).

Checking required fields

Make sure important fields are not empty, and collect any errors.

<?php
  $errors = [];
  $name = trim($_POST["name"] ?? "");
  if ($name === "") {
      $errors[] = "Name is required";
  }
  if (empty($errors)) {
      echo "Form OK";
  } else {
      echo $errors[0];
  }
?>

Collecting errors in an array lets you check every field and show all problems together, instead of stopping at the first one.

Validating an email

Do not write your own email check — use PHP's built-in filter.

<?php
  $email = "aman@site.com";
  if (filter_var($email, FILTER_VALIDATE_EMAIL)) {
      echo "Valid email";
  } else {
      echo "Invalid email";
  }
?>

filter_var with FILTER_VALIDATE_EMAIL is reliable and handles the tricky rules of real email addresses for you.

A full example

<?php
  $errors = [];
  $name  = trim($_POST["name"]  ?? "");
  $email = trim($_POST["email"] ?? "");

  if ($name === "")  $errors[] = "Name required";
  if (!filter_var($email, FILTER_VALIDATE_EMAIL)) $errors[] = "Valid email required";

  if (empty($errors)) {
      $name = htmlspecialchars($name);
      echo "Welcome, $name";
  } else {
      foreach ($errors as $e) echo $e . "<br>";
  }
?>

This pattern — trim, validate, collect errors, then act — is the standard, safe way to handle any PHP form.

Common mistakes

• Trusting browser validation only. It can be bypassed; always re-check in PHP.
• Not using htmlspecialchars when displaying input. This opens the door to XSS.
• Forgetting to trim. Hidden spaces cause failed checks and duplicate records.
• Writing your own email regex. Use filter_var instead — it is correct and simple.

Summary

• Never trust user input — validate and sanitize on the server.
• trim cleans spaces; htmlspecialchars makes input safe to display.
• Check required fields and collect errors in an array.
• Validate email with filter_var($e, FILTER_VALIDATE_EMAIL).
• Always re-validate in PHP even if the browser checks too.

Next, protect pages further with XSS prevention, or store submitted data using sessions and cookies.