I have a PHP form that uses the POST method to get information from form to db. I have my form separate from the form validation and insertion page.
Here is my form:
<?php
//get the header and the navigation bar inside the page.
$page_title = 'Demographics';
include('php_includes/header.html');
?>
<div class="container-fluid" id="emergency_dept">
<form class="form" action="insert_demographics.php" method="post" name="demographics" id="demographics">
<h3>Demographics</h3>
<div class="form-group">
<div>Medical Record Number / Visit ID (Number 17 Characters):</div>
<input class="form-control" id="mrn" name="mrn" type="text" maxlength="17">
</div>
<div class="form-group">
<div>Last Name:</div>
<input class="form-control" id="LastName" name="LastName" type="text" onfocus="emptyElement('status')" maxlength="75">
</div>
<div class="form-group">
<div>First Name:</div>
<input class="form-control" id="FirstName" name="FirstName" type="text" onfocus="emptyElement('status')" maxlength="75">
</div>
<div class="form-group">
<div>Social Security Number:</div>
<input class="form-control" id="SSN" name="SSN" type="text" onfocus="emptyElement('status')" maxlength="9">
</div>
<p></p>
<button type="submit" id="demographicsbtn">Insert Demographics Data</button>
<span id="status"></span>
</form>
</div>
<?php
include('php_includes/footer.html');
?>
Here is my validation and insert page:
<?php
$page_title = 'Insert Demographics';
include('php_includes/header.html');
// Connect to the database
include_once("php_includes/db_connect.php");
// Gather the posted data into local variables
$mrn_demographics = mysqli_real_escape_string($db_connect, preg_replace('/[^a-zA-Z0-9]/', '', $_POST['mrn']));
$last_name = mysqli_real_escape_string($db_connect, preg_replace('/[^a-zA-Z]/', '', $_POST['LastName']));
$first_name = mysqli_real_escape_string($db_connect, preg_replace('/[^a-zA-Z]/', '', $_POST['FirstName']));
$ssn = mysqli_real_escape_string($db_connect, preg_replace('/[^0-9]/', '', $_POST['SSN']));
// Get user IP Address
$ip = preg_replace('#[^0-9.]#', '', getenv('REMOTE_ADDR'));
// Form data error handling
if($mrn_demographics == "" || $last_name == "" || $first_name == "" || $ssn == ""){
echo "The form submission is missing data.";
exit();
} else {
// End form data error handling
$sql = "INSERT INTO nys_demographics (
mrn,
pt_last_name,
pt_first_name,
pt_ssn,
ip_address,
record_insert_dtime
)
VALUES('$mrn_demographics' ,'$last_name','$first_name','$ssn','$ip',
now())";
}
if (mysqli_query($db_connect, $sql)) {
echo "<h3>Demographics have been inserted successfully, you will be auto-directed to the Injury Details form.<br /><br /></h3>";
echo "MRN: $mrn_demographics <br />";
echo "Last Name: $last_name <br >";
echo "First Name: $first_name <br />";
echo "SSN: $ssn <br />";
echo "From IP Address: $ip <br />";
echo "On " .date("Y-m-d") ." at " .date("h:i:sa");
header("refresh:3; url=injury_details.php");
} else {
printf("Error: %s\n", mysqli_error($db_connect));
}
include('php_includes/footer.html');
?>
I have a couple of questions:
- Should my validation code be in a different PHP page or the same?
- Could my validation be better and better written?
I want to echo out what has been input into the form.