Add text within a webpage

Question

So I Made a webpage that has a form, and found some relatively straightforward code to take the contents of a form, check it for errors or incomplete sections, and either return errors or send it. Unfortunately, it returns the errors in a new page rather than within the form page itself, which is what I want it to do.

The HTML form:

    <form name="contactform" method="post" action="send_form.php">
        <table width="450px">
            <tr>
                <td valign="top">
                    <label for="first_name">First Name &#42</label>
                </td>
                <td valign="top">
                    <input type="text" name="first_name" maxlength="50" size="30">
                </td>
            </tr>
            <tr>
                <td valign="top">
                    <label for="last_name">Last Name &#42</label>
                </td>
                <td valign="top">
                    <input type="text" name="last_name" maxlength="50" size="30">
                </td>
            </tr>
            <tr>
                <td valign="top">
                    <label for="email">Email Address &#42</label>
                </td>
                <td valign="top">
                    <input type="text" name="email" maxlength="80" size="30">
                </td>
            </tr>
            <tr>
                <td valign="top">
                    <label for="telephone">Telephone Number</label>
                </td>
                <td valign="top">
                    <input type="text" name="telephone" maxlength="30" size="30">
                </td>
            </tr>
            <tr>
                <td valign="top">
                    <label for="comments">Comments &#42</label>
                </td>
                <td valign="top">
                    <textarea name="comments" maxlength="1000" cols="25" rows="6"></textarea>
                </td>
            </tr>
            <tr>
                <td colspan="2" style="text-align:center">
                    <h6>An astrisk (&#42) denotes a required field.</h6>
                    <input type="submit" value="Submit" />
                </td>
            </tr>
        </table>
    </form>

The PHP code:

if(isset($_POST['email'])) {

$email_to = "my@email.com";
$email_subject = "Comments";


function died($error) {
    //This is where I think the code that prints to the same webpage should be rather than putting on a new page, which is what I does now
    echo "There were error(s) found with the form you submitted. Please review these errors and resubmit.";
    echo "These errors appear below.<br /><br />";
    echo $error."<br /><br />";
    echo "Please go back and fix these errors.<br /><br />";
    die();
}

// validation expected data exists
if(!isset($_POST['first_name']) ||
    !isset($_POST['last_name']) ||
    !isset($_POST['email']) ||
    !isset($_POST['telephone']) ||
    !isset($_POST['comments'])) {
    died('We are sorry, but there appears to be a problem with the form you submitted.');       
}

$first_name = $_POST['first_name']; // required
$last_name = $_POST['last_name']; // required
$email_from = $_POST['email']; // required
$telephone = $_POST['telephone']; // not required
$comments = $_POST['comments']; // required

$error_message = "";
$email_exp = '/^[A-Za-z0-9._%-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,4}$/';
if(!preg_match($email_exp,$email_from)) {
$error_message .= 'The Email Address you entered does not appear to be valid.<br />';
}
$string_exp = "/^[A-Za-z .'-]+$/";
if(!preg_match($string_exp,$first_name)) {
$error_message .= 'The First Name you entered does not appear to be valid.<br />';
}
if(!preg_match($string_exp,$last_name)) {
$error_message .= 'The Last Name you entered does not appear to be valid.<br />';
}
if(strlen($comments) < 2) {
$error_message .= 'The Comments you entered do not appear to be valid.<br />';
}
if(strlen($error_message) > 0) {
died($error_message);
}
$email_message = "Form details below.\n\n";

function clean_string($string) {
  $bad = array("content-type","bcc:","to:","cc:","href");
  return str_replace($bad,"",$string);
}

$email_message .= "First Name: ".clean_string($first_name)."\n";
$email_message .= "Last Name: ".clean_string($last_name)."\n";
$email_message .= "Email: ".clean_string($email_from)."\n";
$email_message .= "Telephone: ".clean_string($telephone)."\n";
$email_message .= "Comments: ".clean_string($comments)."\n";


// create email headers
$headers = 'From: '.$email_from."\r\n".
'Reply-To: '.$email_from."\r\n" .
'X-Mailer: PHP/' . phpversion();
@mail($email_to, $email_subject, $email_message, $headers);  

<!-- email success html -->
<h4>Thank you for contacting us. We will be in touch with you very soon.</h4>
<h4><a class="submitSuccess" href="index.php">Return to Index</a></h4>

}

I basically want it to print a line of text above the textbox saying that the form wasn't filled correctly. Right now it creates a new webpage with the errors.

side-note: There should be a few php brackets, but the code wasn't displaying properly with them in, so I took them out. You get the idea of the code though.

Answer 1

Looking at your code, the basic behavior of the PHP page is to check if there are any validation errors. If yes, show an error message, otherwise send an email.

What you want to do is to show the original page with the validation errors.

Usually, at least in almost every framework I know, this is done by using a redirection. Basically, if there are no errors, we redirect the user to a success page.

If there are errors, we put the error information + the user data in a session variable and redirect to the original form.

The basic code structure would look like this:

the Validation Script:

if ( validate_form($_POST))
{
     /*
         Form validation succeeded, 
         Do whatever processing you want (Like sending an email)
     */    
     header('location: success.php'); // redirect to the success page
}
else
{
     /*
         Form validation failed        
     */
     session_start(); 
     $error = ...;
     $form_data = array('error' => $error, 'username' => $_POST['username'], ...);
     $SESSION['form_data'] = $form_data;
     header('location: form.php');

}

the form Script:

<?php
     session_start(); 
     if( isset($SESSION['form_data']))
     { 
         $username = $SESSION['form_data']['username'];
         $errors = $SESSION['form_data']['error'];
     }
     else
     {
         $username = '';
         $errors = '';          
     }

?>

<form name="contactform" method="post" action="send_form.php">
      <input type="text" name="username" value=<?php $username ?> >       
      <label for="errors"><?php $errors ?></label>   
</form>

PS: This code is a simple demonstration and is obviously not 100% correct. You have to add more exception handling, more security checks... But you get the idea.

I would recommend that you try to use an lightweight MVC framework to understand how this can be done in a correct way. You can even look at the source code of these frameworks.

Answer 2

By saying:

<form name="contactform" method="post" action="send_form.php">

You are telling the HTML form to go to send_form.php in the web browser. Then, in send_form.php, the logic is done to see if the form's contents are correct, so it displays the echo on that new page.

You're going to have to use some script (javascript/php) in the original HTML page to check if the form is filled out correctly.

See something like this: http://www.thesitewizard.com/archive/validation.shtml

Answer 3

When your forms data don't pass your verification server-side you call the function died() with a die() at the end. Please check the PHP help to be sure that die() does what you need. Cause die tell the PHP to stop parsing PHP and send the page AS-IS to the client. So your form will never appear.

Personnaly: I use die function for debugging purpose ONLY