PHP Projects · Lesson 1 of 8

PHP Contact Form

Build a contact-form flow with validation, escaping, and request protection.

Lesson

A contact form should validate name, email, and message on the server, enforce length limits, and use CSRF protection. Escape values when redisplaying errors and send mail through configured infrastructure. Add rate limiting and avoid exposing mail transport errors to visitors. The example validates an email; the application must also validate the message and protect the request. Further guidance Turn the feature into a sequence of small vertical slices: input, validation, domain behavior, persistence, response, and tests. Write acceptance criteria before implementation, protect each operation with authorization, and verify invalid input and failure cases. Document setup and keep deployment secrets out of the repository. Practice task: Create a fresh example for PHP Contact Form. Predict the result before running it, then change one input and explain why the result changes. Test a normal case and one boundary or invalid case where it applies. Compare your output with the example and note one rule you would use in a real project.

Code examples

PHP Contact Form

PHP

$email = filter_input(INPUT_POST, 'email', FILTER_VALIDATE_EMAIL);
if ($email === false || $email === null) {
    echo 'Please enter a valid email.';
}

Expected output

A validation error for an invalid email address

Key points

Build a contact-form flow with validation, escaping, and request protection.
Build and verify one complete feature at a time.
Test invalid input, permissions, and failure paths before deployment.

Your learning progress

Finish this lesson

Optional practice

PHP playground

This site does not execute learner-provided PHP code. Connect a secured PHP sandbox service before enabling code execution.

Execution is disabled. No code is sent to a server.