Challenge - Multi-step registration form
Build a secure registration app with a multi-step form and validation.
Challenge - Multi-step registration form
In this challenge you'll write a validation function for a multi-step registration form. The validateRegistration(array $data): array function checks the email and password fields and collects errors in an array.
For email you use filter_var($email, FILTER_VALIDATE_EMAIL); if invalid you add an error. Password length is checked with strlen. The username is escaped with htmlspecialchars for safe output. This combines form validation and output security.
Validate, then escape
The validation function collects errors in an $errors array. For empty fields you check trim($value) === "". Email format is checked with filter_var; password length with strlen($password) < 8.
When printing the username, htmlspecialchars($name, ENT_QUOTES, "UTF-8") prevents XSS. Validate data from the $_POST superglobal first, then escape it; order matters.
Exercise Write validateRegistration and safeName functions
Write validateRegistration(array $data): array. If $data["email"] is empty, add $errors[] = "Email required"; if filled but invalid per filter_var, add $errors[] = "Invalid email". If strlen($data["password"]) < 8, add $errors[] = "Password too short". Return the $errors array. Also write safeName(string $name): string that returns htmlspecialchars($name, ENT_QUOTES, "UTF-8"). Then call $result = validateRegistration(["email" => "invalid", "password" => "123"]), add foreach ($result as $error) { echo $error . "\n"; }, and add echo safeName("<b>Alex</b>") . "\n".
Show example solution
Define both functions; add email and password checks; write safeName with htmlspecialchars; print with foreach.
Example solution:
<?php
// Write validateRegistration and safeName functions
function validateRegistration(array $data): array {
$errors = [];
$email = trim($data["email"] ?? "");
if ($email === "") {
$errors[] = "Email required";
} elseif (!filter_var($email, FILTER_VALIDATE_EMAIL)) {
$errors[] = "Invalid email";
}
$password = $data["password"] ?? "";
if (strlen($password) < 8) {
$errors[] = "Password too short";
}
return $errors;
}
function safeName(string $name): string {
return htmlspecialchars($name, ENT_QUOTES, "UTF-8");
}
$result = validateRegistration(["email" => "invalid", "password" => "123"]);
foreach ($result as $error) {
echo $error . "\n";
}
echo safeName("<b>Alex</b>") . "\n";Test yourself
-
What does filter_var($email, FILTER_VALIDATE_EMAIL) return?
- true or false
- always the email string
- the email if valid, false otherwise
- always null
Show answer
the email if valid, false otherwise — Correct. It returns the email string when valid, false otherwise. That's why we negate with ! in an if.
-
Complete the filter_var call
$validEmail = filter_var($email, ____);Show answer
$validEmail = filter_var($email, FILTER_VALIDATE_EMAIL); -
Match each function to its job
- filter_var
- validates email
- htmlspecialchars
- prevents XSS
- trim
- strips whitespace
- strlen
- counts length