I have a functioning form page where a user can update their zip code based on their username, which is saved as a session variable.

Everything works except for this new feature to validate the zip code. I have the html5 pattern in place so that if they enter 4 digits, it prompts them to follow the 5 digit format. However, I"m required to validate securely on the server side as well.

I've opted to do a regular expression to match for 5 digits between 0 and 9, and I've nested this in an if statement which is being used to preform the SQL queries. THe issue is that If I enter 123 for the zip code, it still successfully submits. 

Obviously, I need this to only submit if it's 5 digits, otherwise print the error message. I'm wondering if it's something in my structure or syntax. 

Here's the code, thanks for any help:

```
if (isset($_SESSION['missingZipUser'])) {

if(!preg_match("/^[0-9]{5}$/", $_POST['zip'])) {
echo "The ZIP code must be a 5-digit number.";
}else{

  //Query for updating main table first
  $sql = " UPDATE " . table. "
      SET zip= ?
      WHERE uname ?";
  $stmt = odbc_prepare($connect, $sql);
  $success = odbc_execute($stmt, array($_POST['zip'],
  $_SESSION['missingZipUser']));

  //Query for updating both fields in secondary table
  $sql2 = " UPDATE " . table. "
      SET zip1= ?, zip2= ?
      WHERE uname= ?";
  $stmt2 = odbc_prepare($connect, $sql2);
  $success2 = odbc_execute($stmt2, array($_POST['zip'], $_POST['zip'],
  $_SESSION['missingZipUser']));
}
}

```

**UPDATE**
Contrary to some of the comments below, the update code is still passing the info as successful.