Client-Side Validation Alone on a School Quiz Entry Form
A school uses a PHP page to collect entries for an inter-school IT quiz. The HTML form has required, type=email, and a JavaScript function that checks the register number with /^[0-9]{6}$/. The PHP script then builds SQL by directly interpolating $_POST['name'], $_POST['regno'] and $_POST['email'] into an INSERT statement. A student turns off JavaScript, submits register number 12AB and name O'Neil; the page shows a SQL syntax error near Neil. Another student submits a name containing a quote and a comment marker; no table is dropped because mysqli_query sends one statement, but the entries table now contains a bogus row. The teacher wants to know whether the JavaScript check is enough, why the apostrophe broke the query, and how to prevent duplicate email entries under heavy load.
1. Explain why client-side and server-side validation are both needed, and list the server-side checks the PHP script must perform before inserting.
Read the worked answer
JavaScript and HTML attributes run in the browser, which the user controls. A student can disable JavaScript, edit the page, or send a POST request directly with a tool. Client-side checks are useful for quick feedback, but they are not a security or integrity boundary. The PHP script must repeat every essential check on the server: confirm that each field is present and not empty after trimming, check that the name has a reasonable length and allowed characters, check the register number with a server-side pattern such as preg_match('/^[0-9]{6}$/', $regno), and validate the email with filter_var($email, FILTER_VALIDATE_EMAIL). It should also reject unexpected array values where a string is expected. Finally, the database should enforce a UNIQUE constraint on email or on the combination that identifies an entry. Application checks can still race, so the uniqueness rule belongs in the database as well.
2. Rewrite the insert using a prepared statement. Explain how it handles the name `O'Neil` and the injection attempt.
Read the worked answer
$stmt = $conn->prepare(
'INSERT INTO entries (name, regno, email) VALUES (?, ?, ?)'
);
$stmt->bind_param('sss', $name, $regno, $email);
$stmt->execute();
The SQL text is sent to the database separately from the values. The placeholders mark where data will go, and bind_param supplies the values without letting them become SQL syntax. The apostrophe in O'Neil is just a character in the name value; it no longer terminates a string literal in the statement. A value containing a quote and a comment marker is also treated as data, so it cannot change the structure of the query. This is safer and clearer than manually escaping with mysqli_real_escape_string, and it does not depend on remembering every special character. The script should still validate the data before binding, and it should check the return value of execute() so that a duplicate-key error can be handled.
3. Under heavy load, two students can submit the same email at almost the same moment. Describe a correct way to prevent duplicate entries and handle the error.
Read the worked answer
A check-then-insert in PHP is not enough: both requests can check, both can see no existing row, and both can insert. Add a UNIQUE constraint on the email column, or on whatever combination must be unique. Then let the database arbitrate. The PHP code should attempt the insert inside a try/catch block or check the error code after execute(). For MySQL, duplicate-key error 1062 means the constraint rejected the second row. The page can then show a clear message asking the student to use a different email or to confirm an existing entry. If the desired behaviour is to update an existing entry rather than reject it, use INSERT ... ON DUPLICATE KEY UPDATE deliberately and only for the columns that should change. For a quiz entry, rejecting the duplicate is usually safer than silently overwriting another student's details.