Php验证表格

Question

GOAL: Trying to make sure none of the fields are left blank including the radio button set and the dropdown. Anyone?

HTML

<form action="add_p_c.php" method="post"> 
    Professor<input type="radio" name="addType" />&nbsp;&nbsp;Course<input type="radio" name="addType" /> 
    <br><br>Name: <input type="text" name="name" /><br> 
    Department: <select name="deptName"><option>Department 1</option> <option>Department 2</option></select>
    Email: <input type="text" name="email" /><br>
    <input type="submit" name="submit" /> 
</form> 

**PHP (add_p_c.php) **

 <?php
if (isset($_POST['submit'])) {
if (empty($selected_radio)){ echo "You need to select a prof or course";} else(return;)
    $selected_radio = $_POST['addType'];
if (empty($course_prof_name)){ echo "You need to enter a name";} else(return;)
    $course_prof_name = $_POST['name'];
if (empty($select_dep)){ echo "You select a dept";} else(return;)
    $select_dep = $_POST['deptName'];
$email = $_POST['email'] = "[e-mail]"; 
if(eregi("^[_a-z0-9-]+(\.[_a-z0-9-]+)*@[a-z0-9-]+(\.[a-z0-9-]+)*(\.[a-z]{2,3})$", $email)) { 
  return; 
} 
else { 
  echo "<span color='red;'>Invalid email address.</span>"; 
} 
}
?>

Answer 1

For the sake of safety, you should add in certain things to improve security, because if you do any queries to a DB, you could get an SQL injection. Try this:

<?php
if(isset($_POST['submit']){

    $_POST['name']= trim(strip_tags(addslashes($string)));
    $_POST['deptName']= trim(strip_tags(addslashes($string)));
    $_POST['email']= trim(strip_tags(addslashes($string)));

            /* I can't remember if it should be '' or NULL, but some simple testing will let you know which it is*/
    if($_POST['addType'] != ''){
         if($_POST['name'] != ''){
            if($_POST['deptName'] != ''){
                if($_POST['email']) != ''){
                    $selected_radio = $_POST['addType'];
                    $course_prof_name = $_POST['name'];
                    $select_dep = $_POST['deptName'];
                    $email = $_POST['email'] = "[e-mail]"; 
                    if(eregi("^[_a-z0-9-]+(\.[_a-z0-9-]+)*@[a-z0-9-]+(\.[a-z0-9-]+)*(\.[a-z]{2,3})$", $email)) { 
                        return; 
                    } 
                    else { 
                        echo "<span color='red;'>Invalid email address.</span>"; 
                    } 
                }
                else{
                    // email wasn't set
                }
            }
            else{
                //deptName wasn't set
            }
        }
        else{
            //name wasn't set
        }
    }
    else{
        // add type wasn't set
    }
}
?>