html5 - Validate fields on html page with php -

please find code of index.html , submit.php file. of loopo, both working perfect. struggling excatly put validation code (in index.html file or submit.php file). using html5 input types in html file , dont know validation has happen in submit.php file. have multiple forms , made validations.php suggested. not understanding error messages been shown?

can suggest location in submit.php file should add these validations editing submit.php file?
regexp email ('/^[_a-z0-9-]+(\.[_a-z0-9-]+)*@[a-z0-9-]+(\.[a-z0-9-]+)*(\.[a-z]{2,3})$/')
regexp phone (^(?:(?:\+|0{0,2})91(\s*[\-]\s*)?|[0]?)?[789]\d{9}$)

index.html file

<form method="post" action="submit.php">     <div class="box">         <div class="cl"><input type="text" name="name" placeholder="name" /></div>         <div class="cl"><input type="text" name="city" placeholder="city" /></div>         <div class="cl"><input type="text" name="mobile" placeholder="mobile" /></div>         <div class="cl"><input type="email" name="email" placeholder="email" /></div>         <div class="cl"><input type="text" name="sub" placeholder="want 3 m free subscription (yes/no)?"></textarea></div>         <div class="cl"><input type="text" name="slogan" placeholder="suggest slogan 6 m subscription"></textarea></div>     </div>     <div class="srow">         <div class="cl1">             <ul class="action">                 <li><input type="submit" value="submit" /></li>             </ul>         </div>     </div> </form> 

submit.php file

<?php include 'config.php'; // store configuration in seperate file                        // need update once when environment changes  $errors = false; $output = ''; $nl = '<br>'.php_eol; $redirect_url = 'index.html';  if (!$con = new mysqli(dbhost,dbuser,dbpass,dbname)){     $errors = true;     $output .= "error can't connect db".$nl; };      if (!$errors){    //should validate/clean $_post before using in query    $name = $con->escape_string($_post['name']);    $city = $con->escape_string($_post['city']);    $email = $con->escape_string($_post['email']);    $mobile = $con->escape_string($_post['mobile']);    $sub = $con->escape_string($_post['sub']);    $slogan = $con->escape_string($_post['slogan']);     $sql="insert members              (sname, scity, smobile, semail, ssub, sslogan)          values ('$name', '$city', '$mobile', '$email',                 '$sub','$slogan')";     if (!$con->query($sql)){ //forgot parenthesis here earlier       $output .= 'error: db said: ('.$con->errno.') '.$con->error.$nl;       $output .= 'query was:'.$sql.$nl;       $errors = true;    }else{      $output .= "1 record added".$nl;    } }  if (!$errors){    //if there no errors redirect index.html;    header('refresh: 2; url='.$redirect_url);    $output .= '...redirecting...'.$nl; }else{    //show errors , allow display link go back/try again    $output .= '<a href="'.$redirect_url.'">try again</a>'.$nl; } echo $output; ?> 

validations suggested loopo dont know exact location put it. made validations.php file , included in submit.php may syntax wrong because of not working.

function validate_name($input){     // naive rule:     // upper , lower case latin characters , space     // @ least 3 character long     // may want @ allowing other characters such é ö etc.     $input = trim($input); //get rid of spaces @ either end     if (preg_match('/^[a-za-z ]{3,}$/',$input) == 1){         return $input;     }else{         return false;     } }    if (!empty($_post['name']){     if (!$name = $con->escape_string(validate_name($_post['name'])){         $error = true;         $output .= 'error: invalid name: '.$_post['name'].$nl;     }   }else{     $error = true;     $output .= 'error: no name specified'.$nl;   } 

html validations can bypassed sending request directly php file, validating info on server-side choice made.

i suggest better use php's built-in function filter_var, clean code , accurate/safe results, try this:

function validateemail($email){     if(filter_var($email,filter_validate_email)){         return true;     } }  function validatephonenb($nb){     if(filter_var($nb,filter_validate_regexp,array("options"=>array("regexp"=>"/^(?:(?:\+|0{0,2})91(\s*[\-]\s*)?|[0]?)?[789]\d{9}$/"))){         return true;     } } 

and since there no validating phone numbers, used regex, btw can sanitizethe phone number using var_filter before proceeding instead of validating it

i have multiple forms , made validations.php suggested. not understanding error messages been shown

error messages shown in bottom of page since being echoed in end of code

echo $output; ?> 

if not being displaced change position of echoing output containing errors , execute die() after script stop execution after showed errors