[RESOLVED] using PHP for exceptions?

[Blue1974]

If I could get a little direction on this would appreciate it. I'm trying to understand when data on a form is submitted, where the email is entered twice and you want to verify that the emails match and also that they are actually emails.

I have the code below that should do the exception handling but I'm not sure how to bring the variables in from the contact_form.php. I'm tring to set up the variables in the form as $email1 and $email2? Then do I do an includes on the email_check.php?

email_check.php

<?php
class customException extends Exception
  {
  public function errorMessage()
    {
    //error message
    $errorMsg =
    $this->getMessage().'</b> is not a valid E-Mail address <br />
     <form name="" action="contact_form.php" method="post">
     <input type="button" value="Back" onClick="history.go(-1)">
     </form>';
    return $errorMsg;
    }
  }

include ('contact_form.php');

$email1 = "$_POST[email1]"; //here it should be $_POST[email]
$email2 = "$_POST[email2]";

if ($email1 == $email2){

try
  {
  //check if
  if(filter_var($email, FILTER_VALIDATE_EMAIL) === FALSE)
    {
    //throw exception if email is not valid
    throw new customException($email);
    }
  echo '<"form2mail.php">'; //send to next file or thanks for filling out our form
    }

catch (customException $e)
  {
  //display custom message
  echo $e->errorMessage();
  }
}

else {


?>

contact_form.php

<?php
                  $ContactForm="<div id='content'>
                                <span style='position:absolute;top:-50px;'>
                                <form name='contact' action ='email_check.php' method='post'>
                                <input type='hidden' name='_From' value='from email address'>
                                <input type='hidden' name='_To' value='your email address'>
                                <input type='hidden' name='_Subject' value='FEEDBACK'>
                                <input type='hidden' name='_Location' value='contactus.html'>
                                <table width='700' cellspacing='8' cellpadding='4'>
                                <tr>
                                <td algin='left'>
                                <font color='white' face='arial'>First Name: </font>
                                <td>
                                <input type='text' name='fname' value=''>
                                <td align='left'>
                                <font color='white' face='arial'>Last Name:</font>
                                <td>   
                                <input type='text' name='lname' value=''>
                                <tr>
                                <td algin='left'>
                                <font color='white' face='arial'>Address: </font>
                                <td>
                                <input type='text' name='address' value=''>
                                <td align='left'>
                                <font color='white' face='arial'>City:</font>
                                <td>
                                <input type='text' name='city' value=''>
                                <tr>
                                <td algin='left'>
                                <font color='white' face='arial'>State: </font>
                                <td>
                                <input type='text' name='state' value=''>
                                <td align='left'>
                                <font color='white' face='arial'>Zip:</font>
                                <td>
                                <input type='text' name='zip' value=''>
                                <tr>
                                <td align='center' colspan='4' style='color:white;font-family:arial,helvectica;'>
                                Please enter your email address in both boxes
                                <tr>
                                <td algin='left'>
                                <font color='white' face='arial'>Email: </font>
                                <td>
                                <input type='text' name='email1' value='email1'>
                                <td align='left'>
                                <font color='white' face='arial'>Email:</font>
                                <td>
                                <input type='text' name='email2' value='email2'>
                                <tr>
                                <td align='left' colspan='4'>
                                <font color='white' face='arial'>Comments:</font>
                                <tr>
                                <td colspan='4' align='center'>
                                <textarea cols='74' rows='8'>
                                </textarea>
                                <tr>
                                <td align='center' colspan='4'>
                                <input type='submit' value='Send' />
                                <input type='reset' value='Reset' />
                                </td>
                                <tr>
                                </table>
                                </span>
                                </div>";
?>

[SambaNeko]

Hmm, there's a lot to be said here, so I may not get it all in one post, but here goes.

Maybe others will tell you differently, but I feel what you're doing here is needless overkill for your goal(s). Don't make a class, don't throw an exception; just use simple procedural structure.

<?php
$email1 = $_POST["email1"];
$email2 = $_POST["email2"];

if($email1 == $email2){
  if(filter_var($email1, FILTER_VALIDATE_EMAIL) === FALSE){
    $errMsg = "Invalid email address.";
  }else{
    header("Location: nextpage.php");
    exit;
  }
}else{
  $errMsg = "Email addresses don't match.";
}
?>

To get the value of variables submitted by a form, you must access the $_POST array which holds them, then specify the associative name (a string) of the data (whatever was in the "name" attribute of the HTML input element). Thus, $_POST["email1"].

filter_var() is not a good solution for validating email addresses. As is commented on PHP.net's filter_var() page:

Note that FILTER_VALIDATE_EMAIL used in isolation is not enough for most (if not all) web based registration forms.

It will happily pronounce "yourname" as valid because presumably the "@localhost" is implied, so you still have to check that the domain portion of the address exists.

I use regex for this sort of string pattern validation; here's an example.

To redirect to another page, use header().

Don't put all that HTML form markup in a PHP variable. Just put your PHP above the markup, and use something to tell whether or not you need to do validation, or just skip it (in this example, I've used if(isset($_POST["email1"])), but that's not the only option).

<?php
if(isset($_POST["email1"])){
  $email1 = $_POST["email1"];
  $email2 = $_POST["email2"];
  $errMsg = "";

  if($email1 == $email2){
    if(filter_var($email1, FILTER_VALIDATE_EMAIL) === FALSE){
      $errMsg = "Invalid email address.";
    }else{
      header("Location: nextpage.php");
      exit;
    }
  }else{
    $errMsg = "Email addresses don't match.";
  }

  if($errMsg != ""){
    echo "<p>$errMsg</p>";
  }
}
?> 

<div id="content">
<span style="position:absolute;top:-50px;"> 
<!-- etc. -->

[kows]

yeah, that's not really the "correct" way to be using exceptions, either. exceptions shouldn't be thrown in the "main" script; they should be thrown in methods or functions, for the "main" script (or another function or method) to catch and handle. as Samba said, this is simply overkill for what you're doing.

if this was simply an exercise of curiosity, that's fine -- but if you're trying to make a practical application then you're doing a lot of stuff that you really don't need to do in the first place (and I'll bet you don't really understand much about objects yet either).

I would also suggest you stay away from eregi(), or any of the other ereg functions -- these are deprecated. you should be using the preg functions instead. in this case, you want to use preg_match() -- we can use the same basic email pattern, however:

//our email regular expression
$pattern = '/^[_a-z0-9-]+(\.[_a-z0-9-]+)*@[a-z0-9-]+(\.[a-z0-9-]+)*(\.[a-z]{2,3})$/';

//check if the email is correct
if(preg_match($pattern, $email1)){
  header("Location: http://mydomain.com/nextpage.php");
}else{
  echo "You must enter a valid email address.";
} 

try to make sure your header() calls have an absolute URL path, too.

[Blue1974]

Thanks, but I was just trying to learn how to use the exception and implement with my form. So basically, yes just and exercise even if there are more efficient ways to do this. I found the class and exception for checking the email at this link: www.w3schools.com/php/php_exception.asp

This is the code they provided:

<?php
class customException extends Exception
  {
  public function errorMessage()
    {
    //error message
    $errorMsg = 'Error on line '.$this->getLine().' in '.$this->getFile()
    .': <b>'.$this->getMessage().'</b> is not a valid E-Mail address';
    return $errorMsg;
    }
  }

$email = "[email protected]";

try
  {
  //check if
  if(filter_var($email, FILTER_VALIDATE_EMAIL) === FALSE)
    {
    //throw exception if email is not valid
    throw new customException($email);
    }
  }

catch (customException $e)
  {
  //display custom message
  echo $e->errorMessage();
  }
?>

I was just trying to understand how to get the variables into the email_checker.php and how to create the exception and either go forward or go back to re-enter email. Thanks for your advice, but for right now it's easier for me to put all the mark up in the variable.

Thanks again, I'll try to work with what you've given me.

[Blue1974]

If your still with me, then to do as I was trying, even though not recommended. I would proceed like this and I wouldn't need the include like I had?

<?php
class customException extends Exception
  {
  public function errorMessage()
    {
    //error message
    $errorMsg =
    $this->getMessage().'</b> is not a valid E-Mail address <br />
     <form name="" action="contact_form.php" method="post">
     <input type="button" value="Back" onClick="history.go(-1)">
     </form>';
    return $errorMsg;
    }
  }

$email1 = $_POST["email1"];
$email2 = $_POST["email2"];

if($email1 == $email2){
try
  {
  //check if
  if(filter_var($email, FILTER_VALIDATE_EMAIL) === FALSE)
    {
    //throw exception if email is not valid
    throw new customException($email);
    }
  echo '<form2mail.phpl">'; //send to next file or thanks for filling out our form
    }

catch (customException $e)
  {
  //display custom message
  echo $e->errorMessage();
  }
}
?>

[Blue1974]

If your still with me, then to do as I was trying to do this, even though not recommended. I would proceed like this and I don't need the include like I had?

<?php
class customException extends Exception
  {
  public function errorMessage()
    {
    //error message
    $errorMsg =
    $this->getMessage().'</b> is not a valid E-Mail address <br />
     <form name="" action="contact_form.php" method="post">
     <input type="button" value="Back" onClick="history.go(-1)">
     </form>';
    return $errorMsg;
    }
  }

$email1 = $_POST["email1"];
$email2 = $_POST["email2"];

if($email1 == $email2){
try
  {
  //check if
  if(filter_var($email1, FILTER_VALIDATE_EMAIL) === FALSE)
    {
    //throw exception if email is not valid
    throw new customException($email1);
    }
  echo '<form2mail.php">'; //send to next file or thanks for filling out our form
    }

catch (customException $e)
  {
  //display custom message
  echo $e->errorMessage();
  }
}
?>

[kows]

well, I don't know how your form is set up so I can't say for sure, but if your form is submitting to whatever file has this custom exception class, then no -- you do not need to include the contact form. the $_POST variables would be available to that file already. if the contact form is submitting to itself, then you have to check if the server request method is post($_SERVER['REQUEST_METHOD'] == "POST") and then include your custom class file to deal with the user input. this would let the custom class file use the $_POST variables after it was included into your 'main' script. it would probably be much simpler for you to do the former rather than the latter, if this is just an experiment.

[Blue1974]

Yes, my contact_form.php has method = post. If I understand correctly, when the action goes to my email_check.php file. The variables are then included. I think that's what you were trying to tell me.

I've gotten a little further but am wondering about the Comments area from my form. It's not an input type but textarea.

So would this make sense?

<textarea type='hidden' name='textarea' value='$_POST[textarea]'> 

I'm getting this error when I submit: Notice: Undefined index: textarea line 36 of my email_check.php.

Also, is there any difference between:

<input type='submit' value='Send'>";

and

<button type='submit'>Submit</button>";

I tried the ladder and it did seem to work but not sure if it's not recommended?

<?php
class customException extends Exception
  {
  public function errorMessage()
    {
    //error message
    $errorMsg =
    $this->getMessage().'</b> is not a valid E-Mail address <br />
     <form name="" action="contact_form.php" method="post">
     <input type="button" value="Back" onClick="history.go(-1)">
     </form>';
    return $errorMsg;
    }
  }

$email1 = $_POST["email1"];
$email2 = $_POST["email2"];

if($email1 == $email2){
try
  {
  //check if
  if(filter_var($email1, FILTER_VALIDATE_EMAIL) === FALSE)
    {
    //throw exception if email is not valid
    throw new customException($email1);
    }
  echo "<form name='contact' action ='includes/form2mail.php' method='post'>
        <input type='hidden' name='fname' value='$_POST[fname]'>
        <input type='hidden' name='lname' value='$_POST[lname]'>
        <input type='hidden' name='address' value='$_POST[address]'>
        <input type='hidden' name='city' value='$_POST[city]'>
        <input type='hidden' name='state' value='$_POST[state]'>
        <input type='hidden' name='zip' value='$_POST[zip]'>
        <input type='hidden' name='email1' value='$_POST[email1]'>
                          <textarea type='hidden' name='textarea' value='$_POST[textarea]'>
        Email is ok
        <br/>
        <button type='submit'>Submit</button>";
        //send to next file or thanks for filling out our form
    }

catch (customException $e)
  {
  //display custom message
  echo $e->errorMessage();
  }
}
// display message about email entered incorrectly
else{ 
   echo $email1 . ' and ' . $email2 . ' do not match!
   <button value="Back" onClick="history.go(-1)">Back</button>';
   }
?>

[kows]

first: textarea isn't an <input> and doesn't have a type attribute. second: why do you have all of the inputs on your form as hidden fields?

so, anyway -- the thing is that in "strict mode," an undefined index will create a notice/warning. in this case, since you haven't submitted your form yet, you don't have $_POST['textarea'] set. thus, an error occurs. to repopulate the form after submitting, you're going to need to see if this variable is set and then echo out that variable if it is, or do nothing if it isn't. we could place this action in a function so that you could call it for all of your fields:

<?php
  /*
   * function to repopulate form fields; usage -> repopulateField("fieldname")
   */

  function repopulateField($name){

    //if this variable is set, then echo out -- otherwise, do nothing
    if(isset($_POST[$name])){

      //use htmlentities() to make sure that no special characters break our form
      echo htmlentities($_POST[$name]);

    }

  }
?>

on the subject of buttons -- both should do the same thing. I would suggest using the <input> method because it's (in my opinion) easier to write and read, and is very similar to the format of all of your other form elements.

as an aside, I would suggest using concatenation if you're going to echo out all of your HTML (if you insist on doing that in the first place!) -- if you use the function I created in this post, you'll need to make this change anyway:

echo '<input type="hidden" name="fname" value="' . repopulateField("fname") . '" />"; 

[penagate]

That isn't really an appropriate use of exceptions. Exceptions are useful when you have a block of code in which one or more error conditions might occur at any point. One situation where tends to happen is with I/O code or anything that talks to a remote machine. All of the code can be enclosed in a try block and the different types of exceptions caught with one or more catch blocks. Typically you do not throw an exception within a try block. There is no point in doing this.

Exceptions have lots of disadvantages too. In a sense they are like GOTOs: they create a spaghetti structure which can be quite hard to follow. They can also be caught at different levels, which makes it difficult to determine execution flow just by reading the code.


Email validation is not a trivial task. The question "what is a valid email address?" cannot be answered by a generic function; that is up to you. Validating syntax is possible, but complex. Further, it isn't necessarily enough to rely on syntax alone. For example, the address "joe@yomama" is syntactically valid, but probably meaningless to you. If you need to be able to send mail to the address, one thing you can do is extract the domain name from the address and perform a DNS lookup to see if it is reachable from your server. But that doesn't verify that the address actually points to a valid mailbox.

For signup systems, I prefer not to perform any validation on the email address and simply send a confirmation email with a URL that will activate the account. This ensures that the mail delivery can take place.

Also, asking for the email address twice annoys users. The approach works for password fields, but it is pointless with email addresses: the user can see what they have typed, and they can also copy and paste the address (and any mistakes).


Lastly, your HTML output. Scattering chunks of HTML through the code is an expressway to tag soup. You especially should not use echo to emit HTML.

Think of your system as consisting of multiple tiers, even if it's just one small script. HTML is the presentation layer, PHP is the business layer, and the two should be kept as separate as possible.
Anyone reading your code should be able to see the separation:

<?php
  if ($_SERVER['REQUEST_METHOD'] == 'POST')
  {
    # handle a form post
    # redirect to an output page
  }

  # do any other work

  # send output headers
?>
<!DOCTYPE html>
<html lang="en">
  <!-- Your markup goes here -->

  <!-- If need be, you can use conditionals and loops: -->
  <?php if (...): ?>
    <!-- some code -->
  <?php endif; ?>
</html>

See how this approach makes it easier to modify logic and presentation without one breaking the other? It's also much easier to spot and fix invalid markup.

In a more serious system one would use a template approach and not even mix HTML and PHP in the same files.

[Blue1974]

penagate, thanks for going over the procedures. This was just an exercise thats trying to show me how an exception can work. From what everyone has said, it's not sounding like a good example. Hopefully, I can make the code better ore more efficient as I go on. I get confused by the quotes so it's easier for me to echo everything out to get it to work.

kows, I don't know why I used the hidden inputs. I think just to see how they work and to only get the message 'email ok' when directed to my email_checker. I changed it back to "text" so I can see all the fields that were submitted again. Sorry, you kind of lost me on the repopulate. I don't really understand why it's necessary. I would need a seperate function like the one you wrote for each of the fields? I did

<?php
  /*
   * function to repopulate form fields; usage -> repopulateField("fieldname")
   */

  function repopulateField($name){

    //if this variable is set, then echo out -- otherwise, do nothing
    if(isset($_POST[$name])){

      //use htmlentities() to make sure that no special characters break our form
      echo htmlentities($_POST[$name]);

    }

  }
?>

I haven't gotten to repopulating yet so maybe that is what is next for me on this form. I'll come back to this.

I'm still kind of confused by the quoting system, when you gave me this line of code, did you mean for the beginning to have a double quote or should I just use single quotes to enclose everything?

echo '<input type="hidden" name="fname" value="' . repopulateField("fname") . '" />";

I'm not quite sure what happens to the data once it is submitted. The location in the code below is the name of the form and they want me to mail it to an email address? This is the PHP code on the form2mail they gave me to work with:

<?php
session_start();

  $message="The form ".$_POST{"_Location"}." was filled in on ".date("d-m-Y H:i:s (D) (O)")."\n";
  foreach ($_POST as $key => $value) {
    if($key{0} != "_") $message .= "<B>$key</B>: ".nl2br(htmlspecialchars($value))."<br>\n";
  }
  mail($_POST{"_To"}, $_POST{"_Subject"}, $message, "From: ".$_POST{"_From"}."\nContent-type: text/html\n");
?>

[kows]

no, you don't make a new function for every field. you just need that one function, and you call it for every field on the form. you would use this function like so:

<input type="text" name="firstname" value="<?php repopulateField("firstname"); ?>" />

<input type="text" name="lastname" value="<?php repopulateField("lastname"); ?>" />

or, if you would prefer, you would format them like the echo statement in my last post instead. but, you should get the idea of how to use it from this example (I would hope). the parameter you're passing to the function is whatever the name of the text input is.

as far as quotes go, I don't like using single quotes in my HTML (I prefer double quotes), and so if I ever need to echo HTML (which I don't think I ever really need to), I use string literals with single quotes. eg:

//instead of this:
echo "hello";

//I would do:
echo 'hello'; 

but, the idea would be that the word "hello" would be HTML, and I could echo my HTML without needing to escape the attributes, and then I could concatenate my variables when needed:

echo '<a href="http://davidmiles.ca">My website</a>'; 

like mentioned before, though, you should try not to be using echo to emit HTML.


and finally, yes -- the last bit of code you posted is simply taking all of the form fields that were submitted and using the mail() function to send an email. if you're ever confused about a function you see, you can always look it up on PHP.net.

hope that answered that question!

edit: fixed a small syntax error in my example.

[Blue1974]

So, what you are recommending to me is with a large block of code like this:

<php?

 echo "<form name='contact' action ='includes/form2mail.php' method='post'>";
  echo "<input type='hidden' name='_From' value='emailaddress'>";
  echo "<input type='hidden' name='_To' value='emailaddress'>";
  echo "<input type='hidden' name='_Subject' value='FEEDBACK'>";
  echo "<input type='hidden' name='_Location' value='contact.php'>";
  echo "<input type='text' name='fname' value='$_POST[fname]'><br>\n";
  echo "<input type='text' name='lname' value='$_POST[lname]'><br>\n";
  echo "<input type='text' name='address' value='$_POST[address]'><br>\n";
  echo "<input type='text' name='city' value='$_POST[city]'><br>\n";
  echo "<input type='text' name='state' value='$_POST[state]'><br>\n";
  echo "<input type='text' name='zip' value='$_POST[zip]'><br>\n";
  echo "<input type='text' name='email1' value='$_POST[email1]'><br>\n";
  echo "<textarea  type ='text' name='comments' >$_POST[comments]</textarea><br>\n";
  echo "<br>\n";
  echo "Email is ok<br>\n";
  echo "<br>\n";
  echo "<input type='submit' value='Send'>";
  echo "<button value='Back' onClick='history.go(-1)'>Back</button>";

?> 

I would take out all the echoes and make the code something similar to this one line. I'm probably not entering and exiting in the right. I want to try to just get the variable within the php code?

[PHP]
<PHP?
code
?>exit PHP
<input type='text' name='fname' value=<PHP?'$_POST[fname]'?>><br>\n";
[\PHP]

[kows]

err. well, not exactly. you have it half right. you're opening PHP wrong (<?php, not <PHP?), and you're also missing an echo when you're trying to print $_POST['fname'], and your syntax in the HTML is a bit wrong. it would be like this:

<?php
  //code
?><!-- exit PHP -->
<input type="text" name="fname" value="<?php echo $_POST['fname']; ?>"><br />

but, you will still get an error if you're running PHP in strict mode because you're trying to echo $_POST['fname'] when it doesn't yet exist. that variable will only be set when the form has been submitted. that's what the function I created was for, and you would simply change the above to this (to implement that function, if you wanted to):

<?php
  //code
?><!-- exit PHP -->
<input type="text" name="fname" value="<?php repopulateField("fname"); ?>"><br />

the function repopulateField() (from here) will check if the $_POST['fname'] variable is set and will then echo it out if it does -- otherwise, it won't do anything. this lets you repopulate the fields on your form after you've submitted it.

hope that makes sense!