PHP表单输入验证：无效输入时阻止页面跳转并显示错误

你的核心问题是表单直接跳转到结果页，未在当前页面完成完整验证就提交。按以下步骤修改即可解决：

1. 调整表单提交逻辑，验证通过再跳转 #

把表单的action设为当前页面（留空或写<?php echo $_SERVER['PHP_SELF']; ?>），提交后先在当前页完成所有验证，只有所有字段合法时才跳转到结果页。

2. 新增验证通过标记，控制页面跳转 #

在PHP代码开头定义$isValid = true，只要任意字段验证失败，就把$isValid设为false。验证完成后，仅当$isValid为true时，用header()跳转并传递合法参数。

3. 修正原代码中的小错误 #

• 出生日期验证里错误将$dob赋值为$lname，需改为$dob = input($_GET["dob"]);
• 地址验证正则有多余空格，且逻辑反向，调整为允许包含指定字符，不包含则报错
• 表单中"Larst Name"拼写错误，改为"Last Name"

修改后的表单页面代码 #

<!DOCTYPE html>
<html lang="en">
<head>
    <meta charset="UTF-8">
    <meta http-equiv="X-UA-Compatible" content="IE=edge">
    <meta name="viewport" content="width=device-width, initial-scale=1.0">
    <title>FG4</title>
    <style>
        .error {color: red}
    </style>
</head>
<body>
<?php
$fname = $lname = $gender = $mail = $dob = $address = "";
$fnameErr = $lnameErr = $genderErr = $mailErr = $dobErr = $addressErr = "";
$isValid = true; // 验证通过标记

if ($_SERVER["REQUEST_METHOD"] == "GET" && isset($_GET["submit"])) {
    // 验证FirstName
    if (empty($_GET["fname"])) {
        $fnameErr = "Please enter your first name.";
        $isValid = false;
    } else {
        $fname = input($_GET["fname"]);
        if (!preg_match("/^[a-zA-Z-' ]*$/",$fname)) {
            $fnameErr = "Please enter a valid name";
            $isValid = false;
        }
    }

    // 验证LastName
    if (empty($_GET["lname"])) {
        $lnameErr = "Please enter your last name.";
        $isValid = false;
    } else {
        $lname = input($_GET["lname"]);
        if (!preg_match("/^[a-zA-Z-' ]*$/",$lname)) {
            $lnameErr = "Please enter a valid name";
            $isValid = false;
        }
    }

    // 验证Gender
    if (empty($_GET["gender"])) {
        $genderErr = "Please select a gender.";
        $isValid = false;
    } else{ 
        $gender = input($_GET["gender"]);
    }

    // 验证Email
    if (empty($_GET["mail"])) {
        $mailErr = "Please enter your email.";
        $isValid = false;
    } else {
        $mail = input($_GET["mail"]);
        if (!preg_match("/@gmail.com$|@yahoo.com$/", $mail)) { // 加$确保域名在结尾
            $mailErr = "Please enter a valid email.";            
            $isValid = false;
        }
    }

    // 验证Date of Birth
    if (empty($_GET["dob"])) {
        $dobErr = "Please select your date of birth.";
        $isValid = false;
    } else{
        $dob = input($_GET["dob"]); // 修正原赋值错误
    }
    
    // 验证Address
    if (empty($_GET["address"])) {
        $addressErr = "Please enter your address.";
        $isValid = false;
    } else {
        $address = input($_GET["address"]);
        // 调整正则，允许包含#、数字、大小写字母
        if (!preg_match("/[#0-9a-zA-Z]/",$address)) {
            $addressErr = "Please enter a valid address";
            $isValid = false;
        }
    }

    // 所有验证通过才跳转
    if ($isValid) {
        $params = http_build_query([
            'fname' => $fname,
            'lname' => $lname,
            'gender' => $gender,
            'mail' => $mail,
            'dob' => $dob,
            'address' => $address
        ]);
        header("Location: trial.php?$params");
        exit; // 跳转后终止脚本
    }
}

function input($data) {
    $data = trim($data);
    $data = stripslashes($data);
    $data = htmlspecialchars($data);
    return $data;
}
?>

<form method="get" action="<?php echo $_SERVER['PHP_SELF']; ?>">  
    First Name: <input type="text" name="fname" value="<?php echo $fname; ?>"> <!-- 保留用户输入 -->
    <span class="error">* <?php echo $fnameErr;?></span>
    <br><br>

    Last Name: <input type="text" name="lname" value="<?php echo $lname; ?>"> <!-- 修正拼写错误 -->
    <span class="error">* <?php echo $lnameErr;?></span>
    <br><br>

    Gender: <input type="radio" name="gender" value="male" <?php echo ($gender == 'male') ? 'checked' : ''; ?>> Male
            <input type="radio" name="gender" value="female" <?php echo ($gender == 'female') ? 'checked' : ''; ?>> Female
    <span class="error">* <?php echo $genderErr;?></span>
    <br><br>

    Email: <input type="text" name="mail" value="<?php echo $mail; ?>">
    <span class="error">* <?php echo $mailErr;?></span>
    <br><br>

    Date of Birth: <input type="date" name="dob" value="<?php echo $dob; ?>">
    <span class="error">* <?php echo $dobErr;?></span>
    <br><br>

    Address: <br><textarea name="address" rows="5" cols="40"><?php echo $address; ?></textarea>
    <span class="error"><?php echo $addressErr;?></span>
    <br><br>

    <input type="submit" name="submit" value="Submit">  
</form>
</body>
</html>

修改后的结果页（trial.php）代码 #

<!DOCTYPE html>
<html lang="en">
<head>
    <meta charset="UTF-8">
    <meta http-equiv="X-UA-Compatible" content="IE=edge">
    <meta name="viewport" content="width=device-width, initial-scale=1.0">
    <title>Result</title>
</head>
<body>
<?php
// 二次验证，防止直接访问结果页
$fname = $lname = $gender = $mail = $dob = $address = "";
$hasError = false;

if ($_SERVER["REQUEST_METHOD"] == "GET") {
    // 验证每个参数合法性
    if (empty($_GET['fname']) || !preg_match("/^[a-zA-Z-' ]*$/", $_GET['fname'])) {
        $hasError = true;
    } else {
        $fname = htmlspecialchars($_GET['fname']);
    }

    if (empty($_GET['lname']) || !preg_match("/^[a-zA-Z-' ]*$/", $_GET['lname'])) {
        $hasError = true;
    } else {
        $lname = htmlspecialchars($_GET['lname']);
    }

    if (empty($_GET['gender']) || !in_array($_GET['gender'], ['male', 'female'])) {
        $hasError = true;
    } else {
        $gender = htmlspecialchars($_GET['gender']);
    }

    if (empty($_GET['mail']) || !preg_match("/@gmail.com$|@yahoo.com$/", $_GET['mail'])) {
        $hasError = true;
    } else {
        $mail = htmlspecialchars($_GET['mail']);
    }

    if (empty($_GET['dob'])) {
        $hasError = true;
    } else {
        $dob = htmlspecialchars($_GET['dob']);
    }

    if (empty($_GET['address']) || !preg_match("/[#0-9a-zA-Z]/", $_GET['address'])) {
        $hasError = true;
    } else {
        $address = htmlspecialchars($_GET['address']);
    }

    if ($hasError) {
        header("Location: form.php"); // 替换为你的表单页面文件名
        exit;
    }

    // 验证通过显示内容
    echo "<h2> Final Output:</h2>";
    echo "First Name :$fname";
    echo "<br>";
    echo "Last Name :$lname";
    echo "<br>";
    echo "Gender  :$gender";
    echo "<br>";
    echo "Email :$mail";
    echo "<br>";
    echo "Date of Birth :$dob";
    echo "<br>";
    echo "Address :$address";
} else {
    header("Location: form.php");
    exit;
}
?>
</body>
</html>

额外优化说明 #

• 表单输入框保留用户已输入的值，避免验证失败后重新填写
• 性别单选框保留用户之前的选择
• 结果页添加二次验证，防止直接通过URL访问
• 邮箱正则加$确保域名在结尾，避免类似test@gmail.com.cn的错误通过验证

内容的提问来源于stack exchange，提问作者stor-ige