PHP form validation and XSS security
<p>Am new to php and am taking a web application development to allow come across different skill, problems and find a way to fix them.</p>

<p>Am now creating a registration form and validating the form and protecting it against SQL Injection and XSS. <strong>NOTE</strong> I understand could have use prepared statement, but for my level of skill i think starting from Mysqli procedural wold be best result for my development until if fill confident enough.</p>

<p>So i just want you the expert to see if there is something i needed to remove or add or use instead (apart from stmt).</p>

<p><strong>Here is my Register page.</strong></p>

<pre><code>    &lt;?php
    // define mqsqli real escape string function
    function _olaskee($escape) {
      $escape = htmlspecialchars ($escape, ENT_QUOTES, 'UTF-8');
      $escape = trim ($escape, ENT_QUOTES, 'UTF-8');
      $escape = stripcslashes ($escape, ENT_QUOTES, 'UTF-8');
      return $escape;

    }
    // start session
    session_start(); 

    // include database connection
    //require_once('include/connection.php');

    // if user type already detected, redirect to index.php
    if(isset($_SESSION['user_type'])){
      header('Location: index.php');
    }

    // check if we have submited / if the for as being submitted
    if(!empty($_POST['submit'])){

      //instantiate 
        $firstname = _olaskee($con, $_POST['firstname']);
        $lastname = _olaskee($con, $_POST['lastname']);
        $user_name = _olaskee($con, $_POST['user_name']);
        $user_type = _olaskee($con, $_POST['user_type']);
        $password = _olaskee($con, $_POST['password']);
        $confirm_password = _olaskee($con, $_POST['confirm_password']);

          // hash password
        $hashed_password = password_hash($password, PASSWORD_BCRYPT, ['cost' =&gt; 12]);

      // include database connection
      require_once('include/errMsg.php');  

     }
    // include page title
    $title = 'Registration Page';


    // include header layout
    require_once('include/header.php');
    ?&gt;

    &lt;div&gt;

      &lt;form name="register" action="&lt;?php echo htmlspecialchars($_SERVER['PHP_SELF'], ENT_QUOTES, 'UTF-8'); ?&gt;" method="post"&gt;
      &lt;table&gt;
        &lt;tr&gt;
          &lt;td&gt;First Name&lt;/td&gt;
          &lt;td&gt;&lt;input type="text" name="firstname" value='&lt;?php// echo htmlspecialchars ($firstname) ?&gt;'&gt;&lt;br&gt;&lt;span style='color: red'&gt;&lt;?php echo $fnErr ?&gt;&lt;/span&gt;&lt;/td&gt;
          &lt;?php echo $firstname ; ?&gt;
        &lt;/tr&gt;
        &lt;tr&gt;
          &lt;td&gt;Last Name&lt;/td&gt;
          &lt;td&gt;&lt;input type="text" name="lastname" value='&lt;?php echo htmlspecialchars ($lastname) ?&gt;'&gt;&lt;br&gt;&lt;span style='color: red'&gt;&lt;?php echo $lnErr ?&gt;&lt;/span&gt;&lt;/td&gt;
        &lt;/tr&gt;
        &lt;tr&gt;
          &lt;td&gt;User Name&lt;/td&gt;
          &lt;td&gt;&lt;input type="text" name="user_name" value='&lt;?php echo htmlspecialchars ($user_name) ?&gt;'&gt;&lt;br&gt;&lt;span style='color: red'&gt;&lt;?php echo $unameErr ?&gt;&lt;/span&gt;&lt;/td&gt;
        &lt;/tr&gt;
        &lt;tr&gt;

          &lt;td&gt;User Type&lt;/td&gt;
          &lt;td&gt;
    &lt;!-- &lt;label for="flavor"&gt;Select User Type:&lt;/label &gt; --&gt;

    &lt;select id="user_type" name='user_type' &gt;
        &lt;option value=""&gt;Select User Type&lt;/option&gt;
        &lt;option &lt;?php echo $user_type=='rsw'?'selected':''; ?&gt; &gt;rsw&lt;/option&gt;
        &lt;option &lt;?php echo $user_type=='sp'?'selected':''; ?&gt; &gt;sp&lt;/option&gt;
    &lt;/select&gt;
      &lt;span style='color: red'&gt;&lt;?php echo $u_typeErr?&gt;&lt;/span&gt;
          &lt;/td&gt;
        &lt;/tr&gt;

        &lt;tr&gt;
          &lt;td&gt;Email&lt;/td&gt;
          &lt;td&gt;&lt;input type="email" name="email" value='&lt;?php echo htmlspecialchars ($email) ?&gt;'&gt;&lt;br /&gt;&lt;span style='color: red'&gt;&lt;?php echo $emailErr ?&gt;&lt;/span&gt;&lt;/td&gt;
        &lt;/tr&gt;
        &lt;tr&gt;
          &lt;td&gt;Password:&lt;/td&gt;
          &lt;td&gt;&lt;input type="password" name="password" id="password"&gt;&lt;br /&gt;&lt;span style='color: red'&gt;&lt;?php echo $passErr ?&gt;&lt;/span&gt;&lt;/td&gt;&lt;/td&gt;
        &lt;/tr&gt;
        &lt;tr&gt;
          &lt;td&gt;Confirm Password:&lt;/td&gt;
          &lt;td&gt;&lt;input type="password" name="confirm_password" id="confirm_password"&gt;&lt;br /&gt;&lt;span style='color: red'&gt;&lt;?php echo $cpassErr ?&gt;&lt;/span&gt;&lt;/td&gt;&lt;/td&gt;
        &lt;/tr&gt;
        &lt;tr&gt;
          &lt;td&gt;&lt;/td&gt;
          &lt;td&gt;&lt;input type="submit" name="submit" value="Register"&gt;&lt;a href='index.php'&gt; Login&lt;/a&gt;&lt;/td&gt;
        &lt;/tr&gt;
      &lt;/table&gt;
      &lt;/form&gt;   
    &lt;/div&gt;

    &lt;?php
    if(is_file('include/footer.php'))
    include_once('include/footer.php');
    ?&gt;
</code></pre>

<p><strong>And here is my error message page</strong></p>

<pre><code>    &lt;?php

    // error handler variable  
    $fnErr = $lnErr = $unameErr = $u_typeErr = $emailErr = $passErr = $cpassErr = '';
    $firstname = $lastname = $user_name = $user_type = $email = $password = $confirm_password = '';

          // if submit, then validate  
         $firstname = ($_POST['firstname']); 
          // set field validation for first name
          if (empty($firstname)){     
            $fnErr = 'Field empty, please enter your first name';        
          }else{
                    if (strlen($firstname) &lt; 3){ 
                           $fnErr = 'First Name is too short';
                  }
          }
               // check if name only contains letters and whitespace
                      if (!preg_match("/^[a-zA-Z ]*$/",$firstname)) {
                        $fnErr = "Only letters and white space allowed"; 
           }


          // set field validation for last name 
         $lastname = ($_POST['lastname']);
          if (empty($lastname)){     
            $lnErr = 'Field empty, please enter your last name';        
          }else{
                    if (strlen($lastname) &lt; 3){ 
                           $lnErr = 'Last Name is too short';
                  }
          }
                 // check if name only contains letters and whitespace
                      if (!preg_match("/^[a-zA-Z ]*$/",$lastname)) {
                        $lnErr = "Only letters and white space allowed"; 
          }

            // set field validation for user name
          $user_name = ($_POST['user_name']);
          if (empty($user_name)){     
            $unameErr = 'Field empty, please enter user name';        
          }else{
                      if (strlen($user_name) &lt; 6){ 
                             $unameErr = 'Password is too short';
                    }else{

                      if (strlen($user_name) &gt; 15){ 
                             $unameErr = 'Password is too long';                  
                          }
                    }
                }
             // check if name only contains letters and whitespace
                  if (!preg_match("#.*^(?=.*[a-z])(?=.*[A-Z]).*$#",$user_name)) {
                    $unameErr = "At least one CAPS, letters and white space allow";
          }


            // check if user select user type from list
           $user_type = ($_POST['user_type']);
                  if (empty($user_type)){     
                    $u_typeErr = 'Please select user type from list';        
                  }



        // set email filter validation 
           $email = ($_POST['email']);
            if (empty($email)){     
              $emailErr = 'Field empty, please enter your last name';        
            }else{ 
                     // check if e-mail address is well-formed
                     if (!filter_var($email, FILTER_VALIDATE_EMAIL)) {
                        $emailErr = "Invalid email format"; 
                     }
            }


            // set field validation for password
          $password = ($_POST['password']);
          if (empty($password)){     
            $passErr = 'Field empty, please create a password';        
          }else{
                      if (strlen($password) &lt; 6){ 
                             $passErr = 'Password is too short';
                    }else{

                      if (strlen($password) &gt; 15){ 
                             $passErr = 'Password is too long';                  
                          }                          
                    }                                       
                }
                      if( !preg_match("#[A-Z]+#", $password) ) {
                            $passErr = "Password must include at least one CAPS! ";
                  }else{

                     if( !preg_match("#[0-9]+#", $password) ) {
                            $passErr = "Password must include at least one NUMBER! ";
                      }  
                   }
    // //               // check if name only contains letters and whitespace
    //               if (preg_match("#.*^(?=.*[a-z])(?=.*[A-Z])(?=.*[0-9]).*$#", $password)) {
    //                 $passErr = "Try again... Password must contain NUMBER, LETTER and CAPS"; 
    //              }


              // set field validation for confirm password
         $confirm_password = ($_POST['confirm_password']);
          if (empty($confirm_password)){     
            $cpassErr = 'Field empty, please confirm your password';        
          }else{
                    if ($password != $confirm_password) {
                        $cpassErr = 'Error... Passwords do not match';
                  }
          }    


    //   // define mqsqli real escape string function
    // function _olaskee($escape) {
    //   $escape = htmlspecialchars ($escape, ENT_QUOTES, 'UTF-8');
    //   $escape = trim ($escape, ENT_QUOTES, 'UTF-8');
    //   $escape = stripcslashes ($escape, ENT_QUOTES, 'UTF-8');
    //   return $escape;

    // }

    ?&gt;
</code></pre>

<p><strong>NOTE</strong> have commented out some lines in both pages.</p>

<p>Also in the register page have include the security function at the top of the session unsure if that's right.</p>

<p>Also have used the password hashing, but i haven't test in on database yet, but (have i used it right?)</p>

<p>Please just have a look and give me your expert opinion </p>

<p>Best Regards</p>