How is my form being submitted when one of the required date fields is empty?-CodePudding

Most of the forms come through with the DOB entered. A few (out of hundreds) get through with no DOB listed.

The HTML form starts with:

<form id="registration-form"  method="POST">

and the field has Required (relevant bits):

<div >
  <label  id="reg-drj-dob-l" for="reg-drj-dob-f">Date of birth*</label>
  <input  id="reg-drj-dob-f" type="date" name="regDateOfBirth" value="<?php if(isset($_POST["regDateOfBirth"])) echo $_POST["regDateOfBirth"]; ?>" required="required" 
</div>
<div >
  <button  id="reg-new-submit" type="submit" value="submit" form="registration-form" name="regSubmit">Submit</button>
</div> 
<p ><?php echo $_SESSION["regResult"];?></p>
<p ><?php echo $_SESSION["regErrors"];?></p>

The PHP also has validation checks (relevant bits):

    $regDateOfBirth = "";
    if ($_SERVER["REQUEST_METHOD"] == "POST")
    {
      if (empty($_POST["regDateOfBirth"]))
      {
        $regDateOfBirthErr = "Date of birth (required) ";
      } 
      else 
      {
        $tempDateOfBirth = date_create($_POST["regDateOfBirth"]); $regDateOfBirth = date_format($tempDateOfBirth, 'd-m-Y');
      }
    
      $anyDateErr = $regDateOfBirthErr;
        
      if (!$anyDateErr)
      {
        post the form data to a text file on the server and send it in an email
      }
      else 
      {
        $_SESSION["regErrors"] = "There is an error with your: $anyDateErr "; 
      }

(please forgive any syntax errors made from copying and pasting bits from the main, very long file)

When testing, I cannot submit the form without putting a date in that field.

Neither the email with the form on it, nor the text file on the server that I send the field values to, have the DOB in them for this small portion of users.

How can it be that a small number of people are able to submit with an empty field?

Could it be a browser thing?

Or maybe by setting a date field to "" initially I'm causing potential issues?

Update:

I amended the Required attribute. Thanks

I found a form that didn't have a DOB on it, checked the time it was submitted and checked the error logs on the server. That submission seems to have generated the following error:

PHP Warning: date_format() expects parameter 1 to be DateTimeInterface, bool given in /assets/php/form-reg.php on line 97

I changed the PHP validation to:

if (empty($_POST["regDateOfBirth"])){$regDateOfBirthErr = "Date of birth (required) ";
}   
else
{
$tempDateOfBirth = DateTime::CreateFromFormat('Y-m-d', $_POST["regDateOfBirth"]); 
  if ($tempDateOfBirth == FALSE){$regDateOfBirthErr = "Date of birth 
  format incorrect";
  }
  else
  {
    $regDateOfBirth = $tempDateOfBirth->format('d-m-Y');
  }
}

Thanks

I've got a different error to deal with now but I'll need a new post for that

CodePudding user response：

if (empty($_POST["regDateOfBirth"])) this line only check if it is empty or not. If i happen to send wrong date then this condition will satisfy unintentionally (example '154-134-41').

date_create($_POST["regDateOfBirth"]); this function will return false if your date format is incorrect.

date_format($tempDateOfBirth, 'd-m-Y') this will throw exception same as you mentioned if you pass boolean to it.

changing the required attribute on html has nothing to do with this issue.

your server should not assume that it will get right data because you have safe guards on your html. Please validate your data on server properly, irrespective of checks on html/js.