I have a form on my page. I am using jQuery validation for client-side and PHP for server-side validation. I am using PDO. I don't have any issues with client-side and server-side validation. My form is working. I want to know that is this code is the best code with serverside validation with logic?
Client-side validation
<script type = "text/javascript" >
$("#userregister").validate({
rules: {
user_name: {
required: true,
minlength: 3
},
user_profile_pic: {
required: true,
extension: "jpg,jpeg,png",
filesize: 1000000, // <- 1 MB
},
user_email: {
required: true,
email: true,
emailExt: true
},
user_mobileno: {
required: true,
minlength: 10,
maxlength: 10,
number: true,
mobileValidation: true
},
user_city: {
required: true,
minlength: 3
},
terms: {
required: true
},
},
messages: {
user_profile_pic: {
filesize: "File size must be less than 1MB.",
extension: "Sorry, only jpg, jpeg & png files are allowed."
}
},
submitHandler: function(form) {
// alert('hello');
var formData = new FormData(form);
$.ajax({
url: "process.php",
type: "POST",
dataType: "json",
data: formData,
cache: false,
contentType: false,
processData: false,
success: function(response) {
// alert("success");
if (response.error_no === '1') {
$('#formerros').html(response.error);
} else if (response.error_no === '2') {
$('#erroremail').html(response.error);
} else if (response.error_no === '3') {
$('#errorphone').html(response.error);
} else if (response.error_no === '4') {
$('#errorfile').html(response.error);
} else {
window.location = "success";
}
},
}); // AJAX Get Jquery statment
}
});
Server-side validation with logic
function userregister($pdo){
$rv_user_name=validate_data($_POST['user_name']);
$rv_user_email=validate_data($_POST['user_email']);
$rv_user_mobileno=validate_data($_POST['user_mobileno']);
$rv_user_city=validate_data($_POST['user_city']);
$terms=validate_data($_POST['terms']);
$user_profile_pic =" ";
$target_dir = "assets/images/uploads/user_profile_pic/";
$filename = basename($_FILES['user_profile_pic']['name']);
$extension = pathinfo($filename, PATHINFO_EXTENSION);
$new1 = mt_rand();// random number
$new_img_name = $new1.'.'.$extension;
$target_file = $target_dir . $new_img_name;
$uploadOk = 1;
$FileType = pathinfo($target_file,PATHINFO_EXTENSION);
$filename = pathinfo($target_file,PATHINFO_FILENAME);
if(($rv_user_name =="") || ($rv_user_name =="") || ($rv_user_email =="") || ($rv_user_mobileno =="") || ($rv_user_city =="") ) {
$errorMsg[]= "All fields must be completed before you submit the form.";
$code= "1" ;
}
elseif(!preg_match("/^[_\.0-9a-zA-Z-]+@([0-9a-zA-Z][0-9a-zA-Z-]+\.)+[a-zA-Z]{2,6}$/i", $rv_user_email)){
$errorMsg[]= "You did not enter a valid email.";
$code="2";
}
elseif($rv_user_mobileno == "") {
$errorMsg[]="Please enter mobile number.";
$code= "3" ;
}
elseif(is_numeric(trim($rv_user_mobileno)) == false){
$errorMsg[]="Please enter numeric value.";
$code= "3" ;
}elseif(strlen($rv_user_mobileno)<10){
$errorMsg[]="Number should be 10 digits.";
$code= "3" ;
}
else if ($_FILES['reviewer_user_profile_pic']['name'] == ""){
$errorMsg[]="Please upload profile pic.";
$code="4";
}
else if($FileType != "jpg" && $FileType != "jpeg" && $FileType != "png" ) {
$errorMsg[]="Sorry, only jpg, jpeg & png files are allowed.";
$code="4";
$uploadOk = 0;
}
else if ($_FILES["reviewer_user_profile_pic"]["size"] > 1000000) {
$errorMsg[]="Sorry, your file is too large.";
$code="4";
$uploadOk = 0;
}
else{
// Check if $uploadOk is set to 0 by an error
if ($uploadOk == 0) {
$errorMsg[]="Sorry, your file was not uploaded.";
$code="4";
// if everything is ok, try to upload file
} else {
if (move_uploaded_file($_FILES["reviewer_user_profile_pic"]["tmp_name"], $target_file)) {
$imagename= $new_img_name;
} else {
$errorMsg[]="Sorry, there was an error uploading your file.";
$code="4";
}
}
try{
$arrayname=array(
'pd_name'=>$rv_user_name,
'pd_pic'=>$imagename,
'pd_email'=>$rv_user_email,
'pd_contact'=>$rv_user_mobileno,
'pd_city'=>$rv_user_city,
'terms'=>$terms
);
$sql="INSERT INTO `tbl_details`(`pd_name`, `pd_pic`, `pd_email`, `pd_contact`, `pd_city`, `pb_name`,`terms`)VALUES (:pd_name,:pd_pic,:pd_email,:pd_contact,:pd_city,:pb_name,:terms)";
$stmt= $pdo->prepare($sql);
$stmt->execute($arrayname);
$code =5;
$errorMsg= "Success";
$response['error'] = "true";
}
catch(PDOExecption $e) {
$dbh->rollback();
print "Error!: " . $e->getMessage() . "</br>";
$response['error'] = "false";
}
}//else
echo json_encode($response);
}
function validate_data($data)
{
$data = trim($data);
$data = stripslashes($data);
$data = strip_tags($data);
$data = htmlspecialchars($data);
return $data;
}