title: Validate fields on html page with php
body: <p>Please find code of index.html and submit.php file. With the help of <a href="https://stackoverflow.com/users/32763/loopo">loopo</a>, both are working perfect. I am struggling where excatly to put the validation code (in index.html file or submit.php file). i am using html5 input types in html file and I dont know where exactly the validation has to happen in submit.php file. I have multiple forms and I made validations.php as suggested. I am also not understanding where will the error messages been shown? </p>
  
  <p>Can you suggest a location in the submit.php file where I should add these validations by editing my submit.php file? <br>
  Regexp for email (<code>'/^[_a-z0-9-]+(\.[_a-z0-9-]+)*@[a-z0-9-]+(\.[a-z0-9-]+)*(\.[a-z]{2,3})$/'</code>) <br>Regexp for phone (<code>^(?:(?:\+|0{0,2})91(\s*[\-]\s*)?|[0]?)?[789]\d{9}$</code>)</p>
  
  <p><strong>index.html file</strong></p>
  
  <pre><code>&lt;form method="post" action="submit.php"&gt;
      &lt;div class="box"&gt;
          &lt;div class="cl"&gt;&lt;input type="text" name="name" placeholder="Name" /&gt;&lt;/div&gt;
          &lt;div class="cl"&gt;&lt;input type="text" name="city" placeholder="City" /&gt;&lt;/div&gt;
          &lt;div class="cl"&gt;&lt;input type="text" name="mobile" placeholder="Mobile" /&gt;&lt;/div&gt;
          &lt;div class="cl"&gt;&lt;input type="email" name="email" placeholder="Email" /&gt;&lt;/div&gt;
          &lt;div class="cl"&gt;&lt;input type="text" name="sub" placeholder="Want 3 m Free Subscription (Yes/No)?"&gt;&lt;/textarea&gt;&lt;/div&gt;
          &lt;div class="cl"&gt;&lt;input type="text" name="slogan" placeholder="Suggest a slogan for 6 m subscription"&gt;&lt;/textarea&gt;&lt;/div&gt;
      &lt;/div&gt;
      &lt;div class="srow"&gt;
          &lt;div class="cl1"&gt;
              &lt;ul class="action"&gt;
                  &lt;li&gt;&lt;input type="submit" value="Submit" /&gt;&lt;/li&gt;
              &lt;/ul&gt;
          &lt;/div&gt;
      &lt;/div&gt;
  &lt;/form&gt;
  </code></pre>
  
  <p><strong>submit.php file</strong></p>
  
  <pre><code>&lt;?php
  include 'config.php'; // store your configuration in a seperate file so 
                        // you only need to update it once when your environment changes
  
  $errors = false;
  $output = '';
  $nl = '&lt;br&gt;'.PHP_EOL;
  $redirect_url = 'index.html';
  
  if (!$con = new mysqli(DBHOST,DBUSER,DBPASS,DBNAME)){
      $errors = true;
      $output .= "ERROR Can't connect to DB".$nl;
  };   
  
  
  if (!$errors){
     //should validate/clean $_POST before using in query
     $name = $con-&gt;escape_string($_POST['name']);
     $city = $con-&gt;escape_string($_POST['city']);
     $email = $con-&gt;escape_string($_POST['email']);
     $mobile = $con-&gt;escape_string($_POST['mobile']);
     $sub = $con-&gt;escape_string($_POST['sub']);
     $slogan = $con-&gt;escape_string($_POST['slogan']);
  
     $sql="INSERT INTO members 
              (sName, sCity, sMobile, sEmail, sSub, sSlogan)
           VALUES ('$name', '$city', '$mobile', '$email',
                  '$sub','$slogan')";
  
     if (!$con-&gt;query($sql)){ //forgot a parenthesis here earlier
        $output .= 'ERROR: DB said: ('.$con-&gt;errno.') '.$con-&gt;error.$nl;
        $output .= 'Query was:'.$sql.$nl;
        $errors = true;
     }else{
       $output .= "1 record added".$nl;
     }
  }
  
  if (!$errors){
     //if there are no errors redirect to index.html;
     header('refresh: 2; URL='.$redirect_url);
     $output .= '...Redirecting...'.$nl;
  }else{
     //show the errors and allow display a link to go back/try again
     $output .= '&lt;a href="'.$redirect_url.'"&gt;Try again&lt;/a&gt;'.$nl;
  }
  echo $output;
  ?&gt;
  </code></pre>
  
  <p>Validations suggested by <a href="https://stackoverflow.com/users/32763/loopo">loopo</a> but dont know exact location to put it. I made a validations.php file and included in submit.php but may be my syntax is wrong because of which it is not working.</p>
  
  <pre><code>function validate_name($input){
      // fairly naive rule:
      // upper and lower case latin characters and space
      // at least three character long
      // you may want to look at allowing other characters such as é ö etc.
      $input = trim($input); //get rid of spaces at either end
      if (preg_match('/^[a-zA-Z ]{3,}$/',$input) == 1){
          return $input;
      }else{
          return false;
      }
  }
  
    if (!empty($_POST['name']){
      if (!$name = $con-&gt;escape_string(validate_name($_POST['name'])){
          $error = true;
          $output .= 'ERROR: Invalid Name: '.$_POST['name'].$nl;
      }
    }else{
      $error = true;
      $output .= 'ERROR: No name specified'.$nl;
    }
  </code></pre>