I have made a form in HTML and the form data should be send via email. For that purpose I have created a PHP script.

I did read a lot about the importance of form validation in order to prevent hackers on using the form to redirect to different website and other malicious use.

Can someone please check if I secured the form from hackers attacks?


            <form method="post" action="send_form.php">
                <div class="form-group">
                    <label for="input-name">Full name:</label>
                    <input type="text" class="form-control" id="input-name" name="full_name" placeholder="Name Surname" required>
                <div class="form-group">
                    <label for="input-email">Email address:</label>
                    <input type="email" class="form-control" id="input-email" name="email" placeholder="email@domain.xy" required>
                <div class="form-group">
                    <label for="input-date">Wedding date:</label>
                    <input type="text" class="form-control" id="input-date" name="date" placeholder="dd/mm/yyy" required>
                <div class="form-group">
                    <label for="input-location">Location:</label>
                    <input type="text" class="form-control" id="input-location" name="location" placeholder="Town, restaurant">
                <div class="form-group">
                    <button type="submit" class="btn btn-primary" name="submit">Submit</button>

// check if form was submited
if (isset($_POST['submit'])) {
    $name = test_input($_POST['full_name']);
    $emailFrom = test_input($_POST['email']);
    $date = test_input($_POST['date']);
    $location = test_input($_POST['location']);

    $emailTo = "xxx";
    $subject = "Form was submited at xxx by: ".$emailFrom;
    $txt = "
        name: $name \n
        email: $emailFrom \n
        date: $date \n
        location: $location";

    if (mail($emailTo, $subject, $txt)) {
        // return to the main page after form submited
        header("Location: xxx");
// remove empty spaces and convert html characters
function test_input($data) {
    $data = trim($data);
    $data = stripslashes($data);
    $data = htmlspecialchars($data);
    return $data;
  • \$\begingroup\$ Welcome to CodeReview! Please edit your post title to more closely reflect the purpose of the code, perhaps "Wedding ... contact form validation" or so. Apart from that looks good and I hope you get some good reviews, enjoy your stay! \$\endgroup\$
    – ferada
    Sep 30 '18 at 14:36

First of all you must understand that validation and sanitization are not synonyms. But completely different processes that have very little in common.

Whereas sanitization indeed does prevent the malicious use, validation is merely for your and/or your customer's convenience. A properly sanitized data do not require any validation to be safe.


Speaking of the former, there is not so much to sanitize in this form. At least from the list you was able to gather:

  • there is no HTML output, so it makes no sense convert html characters.
  • empty spaces do no harm whatsoever
  • stripslashes always has been useless in the business of preventing any malicious use, while nowadays it's absolutely useless at all

I don't know what harm could be done to the code like this - may be it's better to ask on the security-related site of the network. May be it would be useful to check the input data length and to validate the email address.


Is another matter. You could validate the email address, so it won't allow a bogus email. Same goes for the date - whether it is correct and could be understood. But, as it was said before, it's entirely up to you, whether to bother with validation or not.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.