Chapter 15. Validation and Error Handling

We've already discussed performing validation within our PHP code. In this chapter, we'll explore our options for validating form data before a form submission. We'll also discuss what to do when validation fails, and how to process other errors. We can check information on the client side in the user's browser using JavaScript. We can also check the data when it's submitted directly in PHP.

There's some information that can go out as part of a production error message that is not harmful for end users. For example, it's OK to say that you're having a problem connecting to your database. However, you don't want to reveal more information than is necessary in an error messages that may go out to end users. For example, you don't want to disclose the IP address of your database and certainly not the username that was attempted when you tried to connect. Both of those could aid a potential attacker in breaking in when the database comes back online.