Check PHP validation code

Question

I have made a form in HTML and the form data should be send via email. For that purpose I have created a PHP script.

I did read a lot about the importance of form validation in order to prevent hackers on using the form to redirect to different website and other malicious use.

Can someone please check if I secured the form from hackers attacks?

Form:

            <form method="post" action="send_form.php">
                <div class="form-group">
                    <label for="input-name">Full name:</label>
                    <input type="text" class="form-control" id="input-name" name="full_name" placeholder="Name Surname" required>
                </div>
                <div class="form-group">
                    <label for="input-email">Email address:</label>
                    <input type="email" class="form-control" id="input-email" name="email" placeholder="[email protected]" required>
                </div>
                <div class="form-group">
                    <label for="input-date">Wedding date:</label>
                    <input type="text" class="form-control" id="input-date" name="date" placeholder="dd/mm/yyy" required>
                </div>           
                <div class="form-group">
                    <label for="input-location">Location:</label>
                    <input type="text" class="form-control" id="input-location" name="location" placeholder="Town, restaurant">
                </div>
                <div class="form-group">
                    <button type="submit" class="btn btn-primary" name="submit">Submit</button>
                </div>
            </form> 


<?php
// check if form was submited
if (isset($_POST['submit'])) {
    $name = test_input($_POST['full_name']);
    $emailFrom = test_input($_POST['email']);
    $date = test_input($_POST['date']);
    $location = test_input($_POST['location']);

    $emailTo = "xxx";
    $subject = "Form was submited at xxx by: ".$emailFrom;
    $txt = "
        name: $name \n
        email: $emailFrom \n
        date: $date \n
        location: $location";

    if (mail($emailTo, $subject, $txt)) {
        // return to the main page after form submited
        header("Location: xxx");
    }
}
// remove empty spaces and convert html characters
function test_input($data) {
    $data = trim($data);
    $data = stripslashes($data);
    $data = htmlspecialchars($data);
    return $data;
}
?>

Answer 1

First of all you must understand that validation and sanitization are not synonyms. But completely different processes that have very little in common.

Whereas sanitization indeed does prevent the malicious use, validation is merely for your and/or your customer's convenience. A properly sanitized data do not require any validation to be safe.

Sanitization

Speaking of the former, there is not so much to sanitize in this form. At least from the list you was able to gather:

• there is no HTML output, so it makes no sense convert html characters.
• empty spaces do no harm whatsoever
• stripslashes always has been useless in the business of preventing any malicious use, while nowadays it's absolutely useless at all

I don't know what harm could be done to the code like this - may be it's better to ask on the security-related site of the network. May be it would be useful to check the input data length and to validate the email address.

Validation

Is another matter. You could validate the email address, so it won't allow a bogus email. Same goes for the date - whether it is correct and could be understood. But, as it was said before, it's entirely up to you, whether to bother with validation or not.