当前位置：首页 > PHP

php 实现表单验证

2026-04-02 23:33:22PHP

表单验证的基本方法

在PHP中实现表单验证通常涉及前端和后端的双重验证。前端验证提升用户体验，后端验证确保数据安全性。以下是一些关键方法：

使用filter_var函数验证邮箱和URL：

$email = "test@example.com";
if (!filter_var($email, FILTER_VALIDATE_EMAIL)) {
    echo "Invalid email format";
}

正则表达式验证复杂格式如密码强度：

$password = "Password123";
if (!preg_match("/^(?=.*[a-z])(?=.*[A-Z])(?=.*\d)[a-zA-Z\d]{8,}$/", $password)) {
    echo "Password must contain at least 8 characters, one uppercase, one lowercase and one number";
}

必填字段验证

检查字段是否为空是最基础的验证：

$name = $_POST['name'];
if (empty($name)) {
    echo "Name is required";
}

对于多字段验证，可以创建错误数组收集所有错误：

$errors = [];
if (empty($_POST['username'])) {
    $errors[] = "Username is required";
}
if (empty($_POST['email'])) {
    $errors[] = "Email is required";
}
if (!empty($errors)) {
    foreach ($errors as $error) {
        echo $error . "<br>";
    }
}

数据类型验证

验证数字范围：

$age = $_POST['age'];
if (!is_numeric($age) || $age < 18 || $age > 99) {
    echo "Age must be between 18 and 99";
}

验证复选框或单选按钮：

if (!isset($_POST['agree_terms'])) {
    echo "You must agree to the terms";
}

安全防护措施

防止XSS攻击：

$name = htmlspecialchars($_POST['name']);

防止SQL注入：

$stmt = $pdo->prepare("INSERT INTO users (name) VALUES (:name)");
$stmt->bindParam(':name', $_POST['name']);
$stmt->execute();

文件上传验证

验证上传文件类型和大小：

$allowed = ['jpg', 'jpeg', 'png'];
$ext = pathinfo($_FILES['file']['name'], PATHINFO_EXTENSION);
if (!in_array($ext, $allowed)) {
    echo "Invalid file type";
}
if ($_FILES['file']['size'] > 500000) {
    echo "File too large";
}

验证码实现

简单的数学验证码：

session_start();
$captcha = rand(1000, 9999);
$_SESSION['captcha'] = $captcha;
// 显示给用户
echo "Captcha: " . $captcha;

// 验证用户输入
if ($_POST['captcha'] != $_SESSION['captcha']) {
    echo "Invalid captcha";
}

使用验证库

对于复杂项目，可以考虑使用专业的验证库如Respect\Validation：

use Respect\Validation\Validator as v;

if (!v::email()->validate($_POST['email'])) {
    echo "Invalid email";
}
if (!v::length(6, 12)->validate($_POST['password'])) {
    echo "Password must be 6-12 characters";
}

AJAX实时验证

结合jQuery实现前端实时验证：

$('#email').blur(function() {
    $.post('validate_email.php', {email: $(this).val()}, function(response) {
        $('#email-error').html(response);
    });
});

后端验证脚本validate_email.php：

php 实现表单验证

$email = $_POST['email'];
if (!filter_var($email, FILTER_VALIDATE_EMAIL)) {
    echo "Invalid email format";
    exit;
}
// 检查邮箱是否已存在
$stmt = $pdo->prepare("SELECT id FROM users WHERE email = ?");
$stmt->execute([$email]);
if ($stmt->fetch()) {
    echo "Email already registered";
}