Question About Validation

[eldan88]

I have created a simple login form. With 2 form validation. The first form validation is making sure the password textfield and the username text field is not empty when it is sent.

 

The second validation checks to see if the the username doesn't have more then 10 charachters. However when I enter more then 10 i don't see a message being echoed. out.

 

Below is the code I wrote and I have made a comment called //This is where I need help with the validation...which is where i wrote the code for the max charachters that can be enterned.

 

<?php
session_start();
ob_start(); ?>
<?php require_once("includes/connection.php"); ?>
<?php require_once("includes/functions.php"); ?>

<?php
if(isset($_POST['submit'])) {
$errors = array();
$required_fields = array('username', 'password');
foreach ($required_fields as $field_validation){
if(empty($_POST[$field_validation]) || !isset($_POST[$field_validation])) {
 $errors[] = $field_validation;
 }
}


//This is where I need help with the validation
$max_fields_length = array('username' => 10);
foreach ($max_fields_length as $field => $len) {
if($_POST[$field] > $len) {
  $errors[] = "Username to long";

  }

}
if (empty($errors)) {
$username = $_POST['username'];
$password = $_POST['password'];
$hashed_password = sha1($password);
$query = "SELECT id, username ";
$query .= "FROM login ";
$query .= "WHERE username = '{$username}'";
$query .= "AND hashed_password = '{$hashed_password}'";
$query .= "LIMIT 1 ";
$result = mysql_query($query, $connection);
confirm_query($result);
if (mysql_num_rows($result) == 1) {
$found_user = mysql_fetch_array($result);
$_SESSION['user_id'] = $found_user['id'];
$_SESSION['username'] = $found_user['username'];
redirect_to("content.php");
} else {
//Confirm Query Failed
echo "Login Failed";
echo "<br>";
echo mysql_error();
    }
}else {
$message = "You have the following errors on your form";
}
   }
?>
<?php if(!empty($message)) { echo $message;} ?>
<?php
if(!empty($errors)) {
foreach ($errors as $error) {
echo "<br>";
echo $error; 
 }
}
?>
<form action="login.php" method="post">
Username: <input type="text" name="username" value="">
Password: <input type="password" name="password" value="">
<input type="submit" name="submit" value="submit">
</form>
<?php ob_end_flush(); ?>

[Pikachu2000]

You aren't actually comparing the length of the value entered in $_POST[$field}. You'd need strlen for that.

[eldan88]

You aren't actually comparing the length of the value entered in $_POST[$field}. You'd need strlen for that.

Oh wow. I see that now. Thank you so much for your help!