Form validation help

[sakiblateef]

Hi lads I'm new to php, I'm having a bit of a problem with validation on my form.  If I haven't added the correct data to the form fields it says try again upon clicking the submit button but it still adds to that database what I've typed, what I want it to do is to make sure the correct data is in the fields before it allows it to enter the database.  I'm not sure whats wrong as I'm not very good at php, I've pasted the code below. 

 

Any help would be much appreciated.

 

Thanks.

 

 

 

<?php

 

//define constants for the database

define("USER",          "***********");

define("PASSWORD",      "******");

define("HOST",  "*******");

define("PORT",  "***");

define("DATABASE",      "*********");

 

// (Connect to the database

$connection = mysqli_connect(HOST,USER,PASSWORD, DATABASE, PORT);

 

 

//define fixed part of the query with ? placeholder for runtime variables

define("QUERY", "INSERT INTO members ( dbMemEmailAdd, dbMemPassword, dbMemName, dbMemTelNum, dbMemCreditCard) values (?, ?, ?, ?, ?)");

 

$flag="OK";  // This is the flag and we set it to OK

$msg="";        // Initializing the message to hold the error messages

 

if(strlen($frmMemName) < 2){    // checking the length of the entered  and it must be more than 2 character in length

$msg=$msg."( Member Name has to be more than 2 character length  )<BR>";

$flag="NOTOK";  //setting the flag to error flag.

}

 

if(strlen($frmMemPassword) < 5 ){    // checking the length of the entered password and it must be more than 5 character in length

$msg=$msg."( Member password has to be more than 5 character length  )<BR>";

$flag="NOTOK";  //setting the flag to error flag.

}

 

if(strlen($MemEmailAdd) < 10 ){    // checking the length of the entered password and it must be more than 5 character in length

$msg=$msg."( Member Email has to be more than 10 character length  )<BR>";

$flag="NOTOK";  //setting the flag to error flag.

}

 

 

if(strlen($frmMemTelNum) < 5 ){    // checking the length of the entered password and it must be more than 5 character in length

$msg=$msg."( Member telephone number has to be more than 5 character length  )<BR>";

$flag="NOTOK";  //setting the flag to error flag.

}

 

if($flag <>"OK"){

echo "<center>$msg <br> <input type='button' value='Retry' onClick='history.go(-1)'></center>";

}else{ // all entries are correct and let us proceed with the database checking etc …

}

 

 

//prepare the statement for the query

 

$statement = mysqli_prepare($connection, QUERY);

 

//associate the parameters with the values - one for each ? in the query

//must also provide the type parameter they are

//option for this are

//            'i'  (integer)

//            'd'  (float / double / real - i.e. number with a decimal\oint

//            's'  (string)

 

mysqli_stmt_bind_param($statement,

                      "sssss",    // 3 parameters are integer, string, integer

                      $_REQUEST['frmMemEmailAdd'],

  $_REQUEST['frmMemPassword'],

  $_REQUEST['frmMemName'],

  $_REQUEST['frmMemTelNum'],

                      $_REQUEST['frmMemCreditCard']);

                 

                     

//now try to insert into the database

mysqli_stmt_execute($statement);

 

// check what has happened

switch(mysqli_stmt_errno($statement))

{

case 0: //everything went OK - no errors reported

        $addMemberOutcomeMessage = "Member " . $_REQUEST['frmMemName'] . " added";

        break;

       

case 1062:      //duplicate primary key

$addMemberOutcomeMessage = "Member Number already exsists, use another number";

break;

 

 

}

 

mysqli_stmt_close($statement);

 

mysqli_close($connection);

// go back to home page for the users to decide what to do next

 

 

echo "Added sucessfully.";

echo("<br /><br />");

echo("<a href=\"index.html\">Return to the home page</a>");

?>

[p2grace]

You need to tell the function to quit processing when there's an error.  Put an if statement around your database queries that checks if there was an error, if there wasn't it'll pass the if statement and run the queries, if there was it won't do anything except display the error.