The PHP script to process AJAX inputs - AJAX

This is the most important part; this will do the actual validation work. First start session as well as the database connection:

<?php

//start session to recover captcha answers

session_start();

//connect to database

$username = "xxx";

$password = "xxx";

$hostname = "xxx";

$database = "xxx";

$dbhandle = mysql_connect($hostname, $username, $password)

or die("Unable to connect to MySQL");

$selected = mysql_select_db($database,$dbhandle)

or die("Could not select $database");

The form input from AJAX can be retrieve as well as to do input sanitation:

//extract form inputs

$name =$_POST['name'];

$phonenumber =$_POST['phonenumber'];

$age =$_POST['age'];

$usercaptchaanswer =$_POST['captcha'];

$correctcaptcha = $_SESSION['answer'];

//sanitize early for any possible MySQL entry

$name = mysql_real_escape_string(stripslashes(trim($name)));

$phonenumber = mysql_real_escape_string(stripslashes(trim($phonenumber)));

$age = mysql_real_escape_string(stripslashes(trim($age)));

$usercaptchaanswer = mysql_real_escape_string(stripslashes(trim($usercaptchaanswer)));

$correctcaptcha = mysql_real_escape_string(stripslashes(trim($correctcaptcha)));

The first validation will be to see if the captcha is correct:

//Validate captcha entry

if ($correctcaptcha != $usercaptchaanswer) {

echo 'ERROR: You have entered wrong captcha code';

die ();

}

The next step in the validation is to check for blank fields:

if (empty($name)) {

//name field is blank

echo 'ERROR: The name field is empty.';

die ();

}

if (empty($phonenumber)) {

//phone field is blank

echo 'ERROR: The phone field is empty.';

die ();

}

if (empty($age)) {

//age field is blank

echo 'ERROR: The age field is empty.';

die ();

}

if (empty($usercaptchaanswer)) {

//captcha field is blank

echo 'ERROR: The captcha field is empty.';

die ();

}

Validating the full name can be tricky, so to make sure only the first name and last name are used, and that valid characters have been entered, the validating script is shown below: 

$mystring = $name;

$findme = ' ';

$pos = strpos($mystring, $findme);

$actualposition =$pos + 1;

//count strings

$count =strlen($mystring);

//count the number of characters for the first name

$countfirstname = $actualposition - 1;

//count the number of characters for the last name

$countlastname = $count - $actualposition;

//detect if full name has middle name

$posmid= strpos($mystring,$findme,$actualposition) + 1;

$middleadjust = $posmid - $actualposition;

$purealpha = str_replace(" ", "x", $mystring);

if ($actualposition==1) {

echo 'ERROR: You either forgot your first name or your last name.';

die ();

}

if ($countfirstname <2) {

echo 'ERROR: You are using an invalid first name, it should contain more than one character.';

die ();

}

if ($countlastname <2) {

echo 'ERROR: You are using an invalid last name, it should contain more than one character.';

die ();

}

if ($middleadjust >= 2) {

echo 'ERROR: You should not be using a middle name, please use only first name and last name.';

die ();

}

if (!(ctype_alpha($purealpha))) {

echo 'ERROR: Full name can only consist of alphabetic characters.';

die ();

}

Finally, to validate the age and phone number:

if (!(ctype_digit($phonenumber))) {

echo 'ERROR: A phone number should consist of numerical digits only and no spaces between numbers';

die ();

}

//Step 3.3 Validate age

if (!(ctype_digit($age))) {

echo 'ERROR: Your age should consist of numerical digits only and no spaces between numbers';

die ();

}

You can download and see the actual script.