On input validation
by Naneau
For years I have used PEAR’s HTML_QuickForm and loved it. I based my work flow around it. Basically, QuickForm lets you define a form, with all it’s elements, and attach validation rules to those elements. It could generate HTML for the form, so it was easy to integrate into templates. It had a simple interface for checking for submits and validation errors.
My basic work flow was that I would start by defining a form somewhere, either on the fly, or in a separate class. I used an instance of that form to check whether it was valid (submitted and no validation errors), save some data extracted from the form and redirect to a result page. If the form wasn’t valid (either not submitted, or failed to validate) I would display the form. Just a basic Post/Redirect/Get pattern, that most of you probably are familiar with.
Unfortunately, QuickForm has some problems. The most pressing of all is that it doesn’t fit completely into the MVC pattern. A form is both something in a view (html output) as a controller thing (validation). And because most forms are closely tied to models, they come into play as well.
QuickForm also doesn’t give you a lot of control over it’s output, you can subclass it and use renderers, but that never really worked for me. QuickForm can be complicated and is arguably bloated. There’s also the problem that it has been written for php4 and is therefore anything but future-proof. There’s a QuickForm2 project going, which should address that, though.
I’m currently thinking about a new approach. It has to be as easy as my old one, while still being more flexible. There are three parts to it. Validation, control flow and output. I want to be able to write my validation rules down only once, and base my control structures around it. The output should be both adaptable and quick to write (in a view file).
Detaching validation from the concept of a form is a good thing.
Writing the HTML for forms using view helpers isn’t too hard. So I’ve got that down. But that’s only half the story. I am working on a simple validator class, that accepts validators that it can apply to fields. A controller can pass it an array and check whether it’s valid. It doesn’t matter where the controller got that array from, so it could simply be $_POST, or something else (think ajax).
I would like to validate forms on the client side, without having to write any extra JavaScript for a form. I was most intrigued by Andrew Tetlaw’s approach that I came across a few days ago. It has support for common validation rules, and it is easy to use. You don’t have to write any extra JavaScript for it to work.
Still, it’s not entirely what I’m looking for. I’m working on a javascript class to match the validator class, that allows me to do something similar, but using ajax calls. In server-land I could use my validator class to do the actual validation. I know opinions are divided about using ajax for form validation, but I just hate doing things twice. And apart from that, some validation rules can only be checked on the server, for instance if a database call has to be performed. Of course, JavaScript validation can’t replace server side validation, but it’s a lot faster for the user. A single ajax call to validate a form is faster than reloading an entire page, if the input data didn’t validate.
Expect a follow up on this post
Comments
What a fantastic blog! Your posts cover exactly the stuff I am trying to research and get my head round right now – I am architecting a new framework as part of my job. I’ve come to the conclusion that Zend Framework (not used before) and Smarty (have used before) are the way to go. But I also thought of the whole javascript validation from common rules type thing too.
Who are you working for?
Cheers
Ollie Cronk
Mean’t to say – I am going to add you to my Blog roll…
Ollie