How to Validate Forms with PHP: Server-Side Sanitization & Regex

Server-Side Validation Essentials

Always treat user input as untrusted. Validate format, type, and bounds on the server:

<?php
$email = filter_input(INPUT_POST, 'email', FILTER_VALIDATE_EMAIL);
$amount = filter_input(INPUT_POST, 'amount', FILTER_VALIDATE_FLOAT);

if ($email === false) {
    $errors['email'] = 'A valid email address is required.';
}
if ($amount === false || $amount <= 0) {
    $errors['amount'] = 'Amount must be a positive number.';
}