{form}, {input} and {textarea} write the fields of a form. When the form comes back with mistakes in it, each field shows again what was typed - escaped - and the message for its mistake beside it. padValidate in the page's PHP finds the mistakes.

{form 'contact'}
  {input 'email', type='email', label='E-mail', required}
  {textarea 'message', label='Message', rows=3}
  <button>Send</button>
{/form}

• {form} posts back to the page and carries the session's CSRF token (see Csrf protection) and its name: padPosted ( 'contact' ) is true when this form came back, so a page with two forms knows which one did.
• {input} and {textarea} take the field name first; label= writes a label tied to the field, value= the value before anything was posted, and every other item is an attribute of the field, as {attrs} writes it - required, rows=6, placeholder='...'.
• A checkbox or radio is checked when the posted value is its own value; a password or file field is never refilled.

Validation

padValidate ( $rules ) checks the posted values and answers one message per field that breaks a rule, keyed by the field - empty when all is well. A second argument checks other data; a third replaces messages, per field ('email') or per field and rule ('email.required'):

<?php

  $errors = padValidate (
    [ 'email'   => 'required|email',
      'message' => 'required|max:20' ],
    [ 'email'   => 'ann@',
      'message' => '' ] );

?>

<ul>
  {errors}<li>{$errors}</li>{/errors}
</ul>

The rules: required, email, url, numeric, integer, min:n and max:n (a length, or a value with numeric or integer), in:a,b,c, regex:/.../, same:other_field, accepted and date. An empty field is checked for required and accepted only. A rule name nothing knows is an error.

After a failed post

The fields of the form that came back show the message beside them, in the words of their own label, tied to the field with aria-invalid and aria-describedby so a screen reader reads them together. Here the post is pretended in the PHP, the way a visitor's would arrive:

<?php

  // As if the form had been posted with these values.

  $_SERVER ['REQUEST_METHOD'] = 'POST';
  $_POST = [ 'email' => 'ann@', 'message' => 'Hello' ];

  $errors = padValidate ( [ 'email' => 'required|email', 'message' => 'required' ] );

?>

{input 'email', type='email', label='E-mail'}
{textarea 'message', label='Message', rows=3}

After a post that passes, store it and send the visitor on with padRedirect (): a refresh of the page they land on does not post a second time.

Rules in the template

The rules can stand on the fields themselves: rules='required|email' on an {input} or a {textarea}. They are read from the page's template before its PHP runs, and a post of the form is checked against them there - padPosted ( 'contact' ) is true only for a post that kept them, so the PHP acts on a good post alone. A post that broke one renders the form again, refilled, with the messages beside the fields and the form's error= above them (error alone says "Please correct the errors below."):

<?php

  // Runs after the post was checked against the rules of forms_4.pad, and acts only when
  // it kept them; a post that broke one renders the form again, with its messages.

  if ( padPosted ( 'contact' ) ) {

    padFlash ( 'Thank you for your message.' );

    padRedirect ();

  }

?>

{form 'contact', error='Please correct the errors below.'}
  {input 'email', type='email', label='E-mail', rules='required|email'}
  {textarea 'message', label='Message', rows=3, rules='required|max:2000'}
  <button>Send</button>
{/form}

• Only what is written out counts: quoted rules, on a field with a quoted name, in a {form} with a name that posts back to its own page. Rules on a field in a snippet, a custom tag, a {page} or a layout, rules made from a variable, rules in a form with action= or method='get' and rules on a file field are errors - nothing would check them.
• Every field of the posted form that has rules is checked, also one in an {if} branch that did not render. A field that is there only sometimes keeps its check in the PHP: padValidate adds its messages to those of the template.
• padFormFailed ( 'contact' ) is true when the form came back and broke its rules.