0

I'm trying to make a simple form that can check if the name and email are empty and not in the proper format

here's my code

<!DOCTYPE html>
<html>
<head>
    <title>Register</title>
</head>
<body>

<?php


include ('connect.php');

    $first = $_POST['fname'];
    $last = $_POST['lname'];
    $email = $_POST['email'];

if (isset($_POST['submit']))
{

    if ($first == '' || $first == ' ' || $last == '' || $last == ' '|| $email == "" || $email == " " || !preg_match("/^[a-zA-Z]*$/", $first) || !preg_match("/^[a-zA-Z]*$/", $last) || !filter_var($email, FILTER_VALIDATE_EMAIL))
    {
        if ($first == '' || $first == ' ' )
        {
            $fnameErr = "First name is required!";
        }
        else
        { 
            if(!preg_match("/^[a-zA-Z]*$/", $first))
            {
                $fnameErr = "Only letters are allowed!";
            }
            else
            {
                $fnameErr = "";
            }
        }
        if($last == '' || $last == ' ')
        {   
            $lnameErr = "Last name is required!";
        }
        else
        {
            if(!preg_match("/^[a-zA-Z]*$/", $last))
            {
                $lnameErr = "Only letters are allowed!";
            }
            else
            {
                $lnameErr = "";
            }
        }
        if ($email == "" || $email == " ")
        {
            $emailErr = "Email is required!";
        }
        else
        {
            if(!filter_var($email, FILTER_VALIDATE_EMAIL))
            {
                $emailErr = "Invalid email!";
            }
            else
            {
                $emailErr = "";
            }
        }
    }
    else
    {
        echo "<br>You've successfully created your account<br>";
        mysql_query("INSERT into register SET FNAME='$first', LNAME='$last', EMAIL='$email'")
        or die(mysql_error());
    }
}
?>

<h2 align="center">Registration Form</h2>

<form action="" method="POST" align='center'>
    <p>First Name:
    <input type="text" name="fname">&nbsp;<?php echo $fnameErr; ?>
    <br>
    <p>Last Name:
    <input type="text" name="lname">&nbsp;<?php echo $lnameErr; ?>
    <br>
    <p>&nbsp;&nbsp;
    Email:
    &nbsp;&nbsp;&nbsp;
    <input type="text" name="email">&nbsp;<?php echo $emailErr; ?>
    <br><br>
    </p>
    <input type="submit" value="Submit" name="submit">
</form>
</body>
</html>

I already declared a variables, but when I check it on my browser, it says:

Notice: Undefined variable: fnameErr in /opt/lampp/htdocs/eam/add.php on line 81

Notice: Undefined variable: lnameErr in /opt/lampp/htdocs/eam/add.php on line 84

Notice: Undefined variable: emailErr in /opt/lampp/htdocs/eam/add.php on line 89

Jay Blanchard
  • 34,243
  • 16
  • 77
  • 119
Chikka
  • 1
  • 2
  • The first time you load the page all of those variables are undefined in the form. You have not declared them until the form has been submitted. – Jay Blanchard Apr 13 '17 at 16:01
  • ***Please [stop using `mysql_*` functions](http://stackoverflow.com/questions/12859942/why-shouldnt-i-use-mysql-functions-in-php).*** [These extensions](http://php.net/manual/en/migration70.removed-exts-sapis.php) have been removed in PHP 7. Learn about [prepared](http://en.wikipedia.org/wiki/Prepared_statement) statements for [PDO](http://php.net/manual/en/pdo.prepared-statements.php) and [MySQLi](http://php.net/manual/en/mysqli.quickstart.prepared-statements.php) and consider using PDO, [it's really pretty easy](http://jayblanchard.net/demystifying_php_pdo.html). – Jay Blanchard Apr 13 '17 at 16:01
  • [Little Bobby](http://bobby-tables.com/) says ***[your script is at risk for SQL Injection Attacks.](http://stackoverflow.com/questions/60174/how-can-i-prevent-sql-injection-in-php)***. Even [escaping the string](http://stackoverflow.com/questions/5741187/sql-injection-that-gets-around-mysql-real-escape-string) is not safe! – Jay Blanchard Apr 13 '17 at 16:01
  • you can add @ before variable name to stop firing that error like this @$fnameErr, @$lnameErr – Bhaumik Pandhi Apr 13 '17 at 16:03
  • You should ***never*** do that @PandhiBhaumik always handle errors properly. – Jay Blanchard Apr 13 '17 at 16:47
  • but what if you know that variable will init only based on some conditions. – Bhaumik Pandhi Apr 13 '17 at 17:02

0 Answers0