I have a simple form validation script. Could you tell me how I can improve this script (mainly regarding security)?
HTML page
<form name="input_form" action="process_form.php" method="post">
<p>
<label for="name">Name</label>
<input type="text" name="name" id="name" maxlength="25" />
</p>
<p>
<label for="password">Password</label>
<input type="password" name="password" id="password" maxlength="25" />
</p>
<p>
<label for="email">Email</label>
<input type="text" name="email" id="email" maxlength="100" />
</p>
<p>
<label for="website">Website</label>
<input type="text" name="website" id="website" maxlength="100" />
</p>
<p>
<label for="feedback">Feedback</label>
<textarea name="feedback"></textarea>
</p>
<p>
<label for="sex">Sex</label>
<input type="radio" name="sex" value="male" />Male
<input type="radio" name="sex" value="female" />Female
</p>
<p>
<label for="hobbies">Hobbies</label>
<input type="checkbox" name="hobbies[]" value="reading" />Reading
<input type="checkbox" name="hobbies[]" value="basketball" />Basketball
<input type="checkbox" name="hobbies[]" value="football" />Football
</p>
<p>
<label for="country">Country</label>
<select name="country">
<option value="0">Select</option>
<option value="india">India</option>
<option value="england">England</option>
<option value="usa">USA</option>
</select>
</p>
<p>
<label for="education">Education</label>
<select multiple="multiple" name="education[]">
<option value="high_school">High School</option>
<option value="degree">Degree</option>
<option value="phd">Phd</option>
</select>
</p>
<p>
<input type="submit" name="submit" id="submit" value="Submit" />
<input type="reset" name="reset" id="reset" value="Reset" />
</p>
</form>
process_form.php
<?php
if(isset($_POST['submit']))
{
// white list
$expected_elements = array('name','password','email','website','feedback','country');
// create dynamic variables with same name as the form elements
foreach ($expected_elements as $key)
{
${$key} = $_POST[$key];
}
$error = "";
/*
* This array will store the names of those form elements whose value shouldn't be empty
*/
$check_empty_vars = array('name','password','email','website');
/*
* This array will store the names the form elements and the corresponding max length allowed
*/
$max_allowed_length = array(
"name" => 25,
"password" => 25,
"email" => 100
);
foreach($check_empty_vars as $var_name)
{
if(${$var_name} == "")
{
$error .= ucfirst($var_name) . " cannot be empty <br />";
}
}
foreach ($max_allowed_length as $key => $value)
{
if(strlen(${$key}) > $value)
{
$error .= ucfirst($key) . " cannot be greater than $value characters <br />";
}
}
// letters and spaces only
if( ! preg_match('/^[A-Za-z\s ]+$/', $name))
{
$error .= "Name should contain only letters and spaces <br />";
}
if($email != "")
{
if( ! filter_var($email, FILTER_VALIDATE_EMAIL))
{
$error .= "Enter a valid email <br />";
}
}
if($website != "")
{
if( ! filter_var($website, FILTER_VALIDATE_URL))
{
$error .= "Enter a valid website address <br />";
}
}
if( ! isset($_POST['sex']))
{
$error .= "Select Sex <br />";
}
else
{
switch($_POST['sex'])
{
case 'male':
case 'female':
$sex = $_POST['sex'];
break;
}
}
if( ! isset($_POST['hobbies']))
{
$error .= "Select Hobbies <br />";
}
else
{
switch($_POST['hobbies'])
{
case 'reading':
case 'basketball':
case 'football':
$hobbies = $_POST['hobbies'];
break;
}
}
if($country == "0")
{
$error .= "Select country <br />";
}
if( ! isset($_POST['education']))
{
$error .= "Select education <br />";
}
else
{
switch($_POST['education'])
{
case 'high_school':
case 'degree':
case 'phd':
$education = $_POST['education'];
break;
}
}
echo $error. "<br />";
}
?>