PHP Validation Errors: Show Form Error Messages

When a form has mistakes, tell the user what is wrong and where. The best way is to collect all errors in an array, keyed by field name.

Collect errors

index.php

PHP

<?php
function validateSignup(array $data): array
{
    $errors = [];

    $name = trim($data["name"] ?? "");
    $email = trim($data["email"] ?? "");
    $password = $data["password"] ?? "";

    if ($name === "") {
        $errors["name"] = "Please enter your name.";
    }

    if (filter_var($email, FILTER_VALIDATE_EMAIL) === false) {
        $errors["email"] = "Please enter a valid email address.";
    }

    if (strlen($password) < 8) {
        $errors["password"] = "The password needs at least 8 characters.";
    }

    return $errors;
}

$errors = validateSignup(["name" => "", "email" => "isha@", "password" => "abc"]);

print_r($errors);

Output

OUTPUT

Array
(
    [name] => Please enter your name.
    [email] => Please enter a valid email address.
    [password] => The password needs at least 8 characters.
)

The function checks every field, not just the first one. The user sees all the problems at once and fixes them in one go.

Decide using the array

index.php

PHP

<?php
$errors = [];

if ($errors === []) {
    echo "All good, save the data.";
} else {
    echo "Show the form again with messages.";
}

Output

OUTPUT

All good, save the data.

Show the message next to the field

index.php

PHP

<?php
$errors = ["email" => "Please enter a valid email address."];
?>
<label for="email">Email</label>
<input type="email" id="email" name="email"
       aria-invalid="<?= isset($errors["email"]) ? "true" : "false" ?>"
       <?= isset($errors["email"]) ? 'aria-describedby="email-error"' : "" ?>>
<?php if (isset($errors["email"])): ?>
  <p id="email-error" class="error"><?= htmlspecialchars($errors["email"]) ?></p>
<?php endif; ?>

The accessibility attributes matter:

aria-invalid="true" tells screen readers the field has a problem.
aria-describedby connects the field to its message, so the message is read when the field gets focus.

An error summary

For longer forms, add a summary at the top and move focus to it. Link each item to its field.

index.php

PHP

<?php
$errors = ["name" => "Please enter your name.", "email" => "Please enter a valid email address."];
?>
<?php if ($errors): ?>
<div role="alert" tabindex="-1" id="error-summary">
  <p>Please fix these problems:</p>
  <ul>
    <?php foreach ($errors as $field => $message): ?>
      <li><a href="#<?= htmlspecialchars($field) ?>"><?= htmlspecialchars($message) ?></a></li>
    <?php endforeach; ?>
  </ul>
</div>
<?php endif; ?>

Message writing tips

Say what to do: “Enter a valid email address”, not “Invalid input”.
Do not blame: “The password needs at least 8 characters”, not “You typed a bad password”.
Do not rely on colour alone. Use text, and an icon if you like.
Never reveal secrets: a login form should say “Email or password is incorrect”, not which one.

info

Escape the messages too

Error text that includes what the user typed (for example “‘abc’ is not a number”) must be escaped before printing, like any other output.