We still need to add the code that sends us an email whenever a visitor

fills out our suggest form.

We skipped over that earlier since it was a bit complicated,

but I think that we are ready for that now.

We need to do some validation on the values from the form first.

And then we'll use a third party library to handle the sending.

Remember that suggest.php handles all three steps of

the suggest form process, displaying the form, handling the submission, and

displaying the thank you message.

This code here at the top checks if the REQUEST_METHOD is POST,

which tells us when the form has been submitted.

Right now, a visitor to our site could leave all three fields blank and

submit the form.

We don't want emails without an address to reply to or without any sort of message.

So let's make sure that the name, email address, and details fields have values.

First, we'll write a conditional that checks that the name variable has a value.

We'll put this validation right here.

After we load the values from the post array into our working variables, but

before we generate the email body and send the email.

If the name variable equals an empty string,

let's echo out an error message.

When we encounter a blank value, let's exit so

none of the other code in this file gets processed.

This will catch the case where the name is left blank entirely.

But what if someone types just a space or a tab?

That's kind of like leaving it blank.

So we probably don't want to allow that either.

We can use a trim function like we did in our array category function.

There are three trim functions in php.

ltrim for left trim, rtrim for right trim, and just trim to trim both right and left.

For our right category function, we used the ltrim function.

So we were only trimming characters from the beginning of the string.

We also specified the string that we wanted to trim.

Instead of just trimming white space, by default, each of these trim functions will

trim white space off the beginning and the end of a piece of text.

The white space includes spaces, tabs, and hard returns.

It leaves us spaces between the words.

It just removes them from either the beginning or the end, or both.

If you don't want a blank value in a variable, it's always a good idea to trim

the variable to make sure that it really does have a value.

We could add that trim function here in our conditional, just like this.

That would make our conditional work like we want, but

it would leave the name variable unchanged.

This function returns a trim value, but

it doesn't actually change the original variable.

We'd usually be better off trimming the name variable itself earlier in our code,

so that throughout the rest of the code, we will have a trimmed value.

We'll add the trim to the top of the page.

We also need to trim our email.

And our details variables.

We next want to make sure that the email address has a value.

We can add another conditional just like this one.

But let's try something else.

Let's modify this conditional to check that both variables have a value.

If either one of them is blank, we want to display an error message.

If the name is blank or if the email address is blank, we can add an or

to our conditional to check for that.

We could also use the double pipes.

Again, check the teacher's notes for more information about comparison operators.

We'll add email.

Double equals an empty string.

Let's also check the details variable for a value in this conditional.

We'll add these to the end of our message.

And now we're ready to take a look at the suggest form in the browser.

Let's submit it with blank values.

We display this error now and

stop the form from processing before we try to send an email.

There are two core principles you'll often hear about when dealing with values that

come from outside your code, filter input and escape output.

These principles often work hand in hand.

PHP has a built-in function to help us address these issues right away.

Instead of accepting the form fields directly from our _POST array,

we can use a function called filter_input that filters the input as we're applying

it to our variable.

Let's start taking control.

We'll start by filtering the user input with our filter input function.

We want to keep the trim function, but within the trim function,

instead of using the _POST, we're going to call the function filter_input.

The first argument is the type of input.

So we use INPUT_POST.

The second argument is the name of the variable, our first line being name.

The third argument is our filter.

For our name field, we don't want to allow any tags or

code, so we'll use FILTER_SANITIZE_STRING.

Let's copy and paste this code for the rest of our input values.

For email, we'll change to use the email field.

And we'll use FILTER_SANITIZE_EMAIL instead of string.

For details, we'll change to use details, and

we're going to allow a little more input, even tags.

But we wanna make sure that they use special characters

instead of straight html.

So for details,

we use FILTER_SANITIZE_SPECIAL_CHARS, or chars for short.

This will take any HTML and convert it to special characters.

Great! We've addressed our most harmful attack.

Now, let's take a look at the first attack, the less serious but

pretty annoying comment spam attack.

There are a number of different ways to address this first hack.

I recommend a technique known as a spam honey pot field.

It's not perfect, but it's pretty effective, and

it doesn't degrade the user experience.

Most of these evil robots fill out every field in a form,

just in case they are required, and this technique takes advantage of that.

We need to scroll down and add a new field to our form.

One we don't want our visitors to fill out.

Give it a name and a label that makes it look like a real field,

something like address.

But then we're going to hide this with CSS.

We use style="display:none".

When a visitor to our site views it in a visual browser,

they won't be able to see that field and they'll leave it blank.

But these evil robots don't use a browser.

They simply scrape the html and look for input fields.

They usually don't realize that this field is invisible,

and they'll fill it in with a value.

Back at the top of the form, after our two other checks,

we can check if this field has a value, that is, if it's not blank.

If ($_POST["address"].

Does not equal.

A blank value.

Then we'll assume that an evil robot is filling out this form and

stop executing the file.

echo "Bad form input";, exit.

It's unlikely but

it is possible that the CSS won't load, or our visitor is using a screen reader.

A legitimate visitor to your site might see this field.

Just in case, it's a good idea to display a note with a field.

Most legitimate users won't see this, but

it's a good idea to have it there just in case.

Please leave this field blank.

That was quite a bit of work, but

I felt good about the amount of validation on our form.

Let's now move on and get the third party library in place.