In the following series of videos, we add server-side validation to our
previous simple form (v0).
We will focus on how to structure this code well,
refactoring and improving our code through several stages.
Note that error-messages still missing field-name;
we could add an extra param to 'stringInvalidMsg',
but instead we'll take a different tack next video.
And: the lack of 'br' is a strength, not a weakness.
validate-v4/
Have a function “allErrorMessages” which returns an array of strings.
Now our main handler simply calls that function and echo's the result.
Test-handlers revealed a bug: even text fields may not be in _POST if
an attacker forged a form, giving us array-doesn't-contain-key errors.
Abstract this with safeLookup, a handy trick for many languages and situations.
B+.
video: validate server-side (part 4a) (22m16s)
radford.edu