I am currently making a simple login page. I am using preg_match to check if a username contains only letters and whitespace. If it helps, I am basing it off w3schools example: https://www.w3schools.com/php/php_form_url_email.asp
PHP
<?php
$username = $password = "";
$usernameErr = $passwordErr = "";
if ($_SERVER["REQUEST_METHOD"] == "POST") {
if (empty($_POST["username"])) {
$usernameErr = "A Username Is Required!";
} elseif (!preg_match("/^[a-zA-Z ]*$/",$username) === 0) {
$usernameErr = "Letters and White Space Only!";
} else {
$username = input(isset($_POST["username"]));
}
if (empty($_POST["password"])) {
$passwordErr = "A Password Is Required!";
}
else {
$password = input(isset($_POST["password"]));
}
}
function input($data) {
$data = trim($data);
$data = stripslashes($data);
$data = htmlspecialchars($data);
}
?>
HTML
<!DOCTYPE HTML>
<html>
<head>
<style>
.error {color: #FF0000;}
</style>
</head>
<body>
<h2>PHP Form Validation Example</h2>
<p><span class="error">* required field.</span></p>
<form method="post" action="<?php echo htmlspecialchars($_SERVER["PHP_SELF"]);?>">
Username: <input type="text" name="username">
<span class="error">* <?php echo $usernameErr;?></span>
<br><br>
Password: <input type="text" name="password">
<span class="error">* <?php echo $passwordErr;?></span>
<br><br>
<input type="submit" name="submit" value="Submit">
</form>
</body>
</html>
The value of $username is not changed between
$username = $password = "";
and
} elseif (!preg_match("/^[a-zA-Z ]*$/",$username) === 0) {
I think you meant to write
} elseif (!preg_match("/^[a-zA-Z ]*$/",$_POST['username']) === 0) {
Further, attempting to do an explicit integer type match on the return value for preg_match() is a bit silly. Particuarly if you perform a boolean negate on the value. This would be better:
} elseif (!preg_match("/^[a-zA-Z ]+$/",trim($_POST['username']))) {
Then just when we though it couldn't get any worse...
$username = input(isset($_POST["username"]));
Are you aware of what isset() does? It returns a boolean which you are processing with your input function. But since your function doesn't return a value you are setting $username to null.
Consider
$username = input($_POST["username"]);
...
function input($data) {
$data = trim($data);
$data = stripslashes($data);
$data = htmlspecialchars($data);
return $data;
}
There's a lot more wrong with the code, but that is enough clues.
I would strongly recommend that you when experimenting with code you put
error_reporting(E_ALL | E_STRICT);
at the top of your code and clean out all the warnings PHP will tell you about (the "| E_STRICT" is redundant if your PHP install is up to date).