If a user has a valid value, such as a name or an email that your validation doesn’t allow, they can notify you (the site owner/administrator/developer) via a ‘contact us’ page about the problem, so that the validation logic can be adjusted. If it is not valid, tell the user and let them correct the problem. So, someone tries to register on a site, their valid email address gets changed and used, and everything dependent on having the correct email address for them doesn’t work. In this case, this will remove characters from valid email addresses, rendering them useless. Do NOT modify user submitted data and use it, as this changes the meaning of the data. Some legal email addresses may be changed.Īllowed character regular expression: repeat this again. This function uses a smaller allowable character set than the set defined by RFC 5322. It is used to strip whitespace from the beginning and end of a string or both side of a string. Strips out all characters that are not allowable in an email.Īfter sanitize_email() has done its work, it passes the sanitized e-mail address through the sanitize_email filter. PHP string trim() function is in-built function. The trim () function removes whitespace and other predefined characters from both sides of a string. if the value is not a string or array - it will remain. The sanitize_email() function that the OP indicated is probably from wordpress - given an array - it will recursively add / strip slashes from the array and all of it subarrays. For a value being used in a html context, apply htmlentities() to it when you output it in the html context. For a value being used in an sql context, use a prepared query. The way to secure an application is to use each data value safely in whatever context it is being used in. ‘Sanitize’ implies cleaning or making a value safe to use. If the data was not valid (the array holding the user/validation error messages is not empty), you would display the error message(s) when you redisplay the form, either all at once or individually adjacent to the field they correspond to, repopulate the form field values with the submitted form data, so that the user doesn’t need to keep reentering data over and over, let the user correct the validation problems, and resubmit the form.

If the data passes all the validation tests (the array holding the user/validation error messages is empty), you use it. If you use an array to hold user/validation error messages, with the main index being the field name, it is easy to manage dependent validation tests and to test if there are or are not any user/validation errors. If it does not, you setup a message for the user letting them know that it does not. If a ‘required’ value is an empty string, you setup a message for the user letting them know that it is required.įor a value that must have a specific format, like an email address, you validate if it does or does not have that format. You validate a ‘required’ field, by checking if the trimmed value is an empty string or not. Other than trimming user submitted data, mainly so that you can detect if it is all white-space characters, do NOT modify user submitted data. You validate data to make sure it meets the ‘business’ needs of your application.

Php trim form