PHP mail form help

[KathleenODell]

I've cobbled together some php code to get a contact form together. Everything works but one thing. I'm trying to make the fields required and I must have missed a step. Right now the form just goes through even if you haven't filled anything out. Can anyone help? I've redacted a few bits for security purposes.

<?php

    function post_captcha($user_response) {

        $fields_string = '';

        $fields = array(

            'secret' => 'code goes here',

            'response' => $user_response

        );

        foreach($fields as $key=>$value)

        $fields_string .= $key . '=' . $value . '&';

        $fields_string = rtrim($fields_string, '&');

        $ch = curl_init();

        curl_setopt($ch, CURLOPT_URL, 'https://www.google.com........');

        curl_setopt($ch, CURLOPT_POST, count($fields));

        curl_setopt($ch, CURLOPT_POSTFIELDS, $fields_string);

        curl_setopt($ch, CURLOPT_RETURNTRANSFER, True);

        $result = curl_exec($ch);

        curl_close($ch);

        return json_decode($result, true);

    }

    // Call the function post_captcha

    $res = post_captcha($_POST['g-recaptcha-response']);

    if (!$res['success']) {

        // What happens when the CAPTCHA wasn't checked

        echo '<p>Please go back and make sure you check the security CAPTCHA box.</p><br>';

    } else {

        // If CAPTCHA is successfully completed...

    $name = $_POST['name'];

    $email = $_POST['email'];

    $message = $_POST['message'];

    $from = 'From: localhost';

    $to = 'email@email.com';

    $subject = 'RMA Request';

$body = "From: $name\n E-Mail: $email\n Message:\n $message";

    if ($_POST['submit']) {

    if (mail ($to, $subject, $body, $from))

header('Location:www.whatevertheaddresswillbe.html');

} else {

        echo '<p>You need to fill in all required fields!!</p>';

    }

}

?>

[WolfShade]

It's been a long time since I last worked with PHP, but I did a quick Google search and found:

https://www.sitepoint.com/form-validation-with-php/

It explains form validation in PHP quite well, I think.  Hope it helps.

V/r,

^ _ ^

[KathleenODell]

Thanks. I'll take a look at it and see if I can figure out what I did wrong. I know it's just because I had to Frankenstein a few things together that I've just overlooked something. Hopefully, someone might be able to spot my mistake before I pull all my hair out.

[WolfShade]

The "mistake" was not having form validation, nothing else.  The rest of your code seems fine, to me.  It's just an absence of form validation.  If, after you assign form values to variables (ie, "$name = $_POST['name'];"), you use if/else or switch/case conditionals to check and make sure something is actually filled in, then it should stop form submission and alert the user to make the correction.  Also, a good idea would be to trim() the values, so no one can enter just spaces and bypass the validation.

HTH,

^ _ ^

UPDATE: Also, you can use Regular Expressions to make sure that what is entered is proper (like email addresses, phone numbers, etc.)

UPDATE2:  Here is a link on how to validate an email address using PHP Regular Expression:

https://stackoverflow.com/questions/28399610/validate-email-in-php-using-regex

[KathleenODell]

Okay I still must be missing something though. Or more likely just not understanding. Following along with the example on that site I added if else statements to the code. But the form still submits without having to fill everything in.

$name = $_POST['name'];

if (empty($_POST['name'])) {

$nameErr = "Missing";

}

else {

$name = $_POST['name'];

}

    $email = $_POST['email'];

if (empty($_POST['email'])) {

$nameErr = "Missing";

}

else {

$name = $_POST['email'];

}

    $message = $_POST['message'];

if (empty($_POST['message'])) {

$nameErr = "Missing";

}

else {

$name = $_POST['message'];

}

    $from = 'From: localhost';

    $to = 'email@email.com';

    $subject = 'RMA Request';

$body = "From: $name\n E-Mail: $email\n Message:\n $message";

    if ($_POST['submit']) {

    if (mail ($to, $subject, $body, $from))

header('Location:site address here');

} else {

        echo '<p>You need to fill in all required fields!!</p>';

    }

}

[WolfShade]

I know you're in a hurry, but you should go back and thoroughly read the tutorial instead of just scanning what you think you need.  There's a lot more that needs to be done.  You are checking for values, yes, but you don't have a conditional that checks to see if the $xxxErr variables are blank or have content, and preventing the submit.

Read the whole tutorial and get an understanding of what the full process is.  It will take just a few minutes, and you'll be able to fix this. 

V/r,

^ _ ^

[osgood_ · Accepted solution]

If your form fields are empty assign them to an error variable.

So instead of what you have now

$nameErr = "Missing";

Use

$error['name'] = "plesse provide your name";

Do this for each form field you want the user to fill in

Then instead of

if($_POST['submit']) {

Use

If(!$error) {

That says if no errors send the form data.

Or instead if you dont want to create an error array you can check the form fields are not empty instead of checking if the submit button has been clicked

If you use the error srray approach you can echo out the meesage beneath esch form field

<?php If(isset($error['name']) {

echo $error['name'];

}

?>

Depends how much eye vandy you want to include or just a basic form

[KathleenODell]

Thanks! I'll give that a shot

[osgood_]

Hopefully that has worked for you despite a few spelling errors on my part, using a silly smartphone keyboard to try and type code is not advisable.

Using server side validation methods are a lot more robust than server side alone. Ideally you would combine the two to take advantage of some nice effects using client side javascript whilst backing it up with a more solid approach

[KathleenODell]

It did help, thank you. What I know I'll need to end up doing is going back later and reworking the whole thing to clean it up and get it to do exactly what I need it to do. But for now, it's at least popping up with an error alert saying to fill in forms. I'm supposed to be launching the site in 10 minutes and they came in an hour ago and asked me to add 6 different forms to the site! So there was a mad rush to cobble code together.

[osgood_]

That would be the client side validation working if youre getting boxes popping up, which is good but when you have time l would check the server side validation is also working by temporarily removing the 'required' attribute on the form field. You will then have a more solid solution.

[Nancy OShea]

Add required attributes to all HTML5 form input fields that must not be left blank.

<form action="/action_script.php">
   Username: <input type="text" name="usrname" required><br>

   Email: <input type="email" name="email" required>
   <input type="submit">
</form>

[KathleenODell]

I'll add that, thank you!