Question

I need help please to add function for clean up any inputs form that we receive from the users for this code below :

<?php
session_start();

// initializing variables
$fname = "";
$lname = "";
$address = "";
$city = "";
$state = "";
$zip = "";
$email = "";
$phone = "";
$errors = array();

// connect to the database
$db = mysqli_connect("localhost","root","password","db");

// REGISTER USER
if (isset($_POST['reg_user1'])) {
// receive all input values from the form
$fname = mysqli_real_escape_string($db, $_POST['fname']);
$lname = mysqli_real_escape_string($db, $_POST['lname']);
$address = mysqli_real_escape_string($db, $_POST['address']);
$city = mysqli_real_escape_string($db, $_POST['city']);
$state = mysqli_real_escape_string($db, $_POST['state']);
$zip = mysqli_real_escape_string($db, $_POST['zip']);
$email = mysqli_real_escape_string($db, $_POST['email']);
$phone = mysqli_real_escape_string($db, $_POST['phone']);
$password_1 = mysqli_real_escape_string($db, $_POST['password_1']);
$password_2 = mysqli_real_escape_string($db, $_POST['password_2']);

// form validation: ensure that the form is correctly filled ...
// by adding (array_push()) corresponding error unto $errors array
if (empty($fname)) { array_push($errors, "First name is required"); }
if (empty($lname)) { array_push($errors, "Last name is required"); }
if (empty($address)) { array_push($errors, "Address is required"); }
if (empty($city)) { array_push($errors, "City is required"); }
if (empty($state)) { array_push($errors, "State is required"); }
if (empty($email)) { array_push($errors, "Email is required"); }
if (empty($phone)) { array_push($errors, "Phone number is required"); }
if (empty($password_1)) { array_push($errors, "Password is required"); }
if ($password_1 != $password_2) {
   array_push($errors, "The two passwords do not match");
}
// first check the database to make sure
// a user does not already exist with the same username and/or email
$user_check_query = "SELECT * FROM member WHERE phone='$phone' OR email='$email' LIMIT 1";
$result = mysqli_query($db, $user_check_query);
$user = mysqli_fetch_assoc($result);
  
if ($user) { // if user exists
if ($user['phone'] === $phone) {
array_push($errors, "Phone Number already exists");
}

if ($user['email'] === $email) {
array_push($errors, "email already exists");
}
}

// Finally, register user if there are no errors in the form
if (count($errors) == 0) {

   $query = "INSERT INTO member (fname, lname, address, city, state, zip, email, phone, password)
           VALUES('$fname', '$lname', '$address', '$city', '$state', '$zip', '$email', '$phone', '$password_1')";
   mysqli_query($db, $query);
   $_SESSION['fname'] = $fname;
   $_SESSION['success'] = "You are now logged in";
header('location: indexMember.php');
}
}

// LOGIN USER
if (isset($_POST['login_member'])) {
$fname = mysqli_real_escape_string($db, $_POST['fname']);
$password = mysqli_real_escape_string($db, $_POST['password']);

if (empty($fname)) {
   array_push($errors, "Username is required");
}
if (empty($password)) {
   array_push($errors, "Password is required");
}

if (count($errors) == 0) {
   $password_1 = md5($password);
   $query = "SELECT * FROM member WHERE fname='$fname' AND password='$password'";
   $results = mysqli_query($db, $query);
   if (mysqli_num_rows($results) == 1 ){
   $_SESSION['fname'] = $fname;
   $_SESSION['success'] = "You are now logged in";
   header('location: indexMember.php');
   }else {
       array_push($errors, "Wrong username/password combination");
   }
}
}

?>

Answer 1

Data validation is an integral part of working with forms.Not only can invalid submitted data lead to security problems,but i can also break the webpage.

"filter_var" function is used to remove illegal characters and validate data.

if (empty($fname)) { array_push($errors, "First name is required"); }

$new_string = filter_var($fname,FILTER_SANITIZE_STRING);   //Remove all html tags from string.

if (empty($lname)) { array_push($errors, "Last name is required"); }

$new_stringa = filter_var($lname,FILTER_SANITIZE_STRING);   //Remove all html tags from string.

if (empty($address)) { array_push($errors, "Address is required"); }

$new_stringb = filter_var($address,FILTER_SANITIZE_STRING);   //Remove all html tags from string.

if (empty($city)) { array_push($errors, "City is required"); }

$new_stringc = filter_var($city,FILTER_SANITIZE_STRING);   //Remove all html tags from string.

if (empty($state)) { array_push($errors, "State is required"); }

$new_stringd = filter_var($state,FILTER_SANITIZE_STRING);   //Remove all html tags from string.

if (empty($email)) { array_push($errors, "Email is required"); }

echo filter_var($_POST['email'],FILTER_SANITIZE_EMAIL); //This function will remove any characters that should not occur in EMAIL type.

if (empty($phone)) { array_push($errors, "Phone number is required"); }

$new_var = filter_var($phone,FILTER_SANITIZE_INT;

if (empty($password_1)) { array_push($errors, "Password is required"); }

if ($password_1 != $password_2) {

   array_push($errors, "The two passwords do not match");
}

This part of your code only validates whether the input file contains any data. It doesn't check for invalid data.

filter_var function will sanitize and validate data.

Sanitizing will remove any illegal character from the data.

Validating will determine the data is in proper form.

I have added the functions for sanitizing data in the above code.

Hope this helps.!