PHP form validation and db insertion, one page or two I have a PHP form that uses the POST method to get information from form to db. I have my form separate from the form validation and insertion page.

Here is my form:

&lt;?php
//get the header and the navigation bar inside the page.
$page_title = 'Demographics';
include('php_includes/header.html');
?&gt;

&lt;div class="container-fluid" id="emergency_dept"&gt;
    &lt;form class="form" action="insert_demographics.php" method="post" name="demographics" id="demographics"&gt;
    &lt;h3&gt;Demographics&lt;/h3&gt;

    &lt;div class="form-group"&gt;
        &lt;div&gt;Medical Record Number / Visit ID (Number 17 Characters):&lt;/div&gt;
        &lt;input class="form-control" id="mrn" name="mrn" type="text" maxlength="17"&gt;
    &lt;/div&gt;

    &lt;div class="form-group"&gt;
        &lt;div&gt;Last Name:&lt;/div&gt;
        &lt;input class="form-control" id="LastName" name="LastName" type="text" onfocus="emptyElement('status')" maxlength="75"&gt;
    &lt;/div&gt;

    &lt;div class="form-group"&gt;
        &lt;div&gt;First Name:&lt;/div&gt;
        &lt;input class="form-control" id="FirstName" name="FirstName" type="text" onfocus="emptyElement('status')" maxlength="75"&gt;
    &lt;/div&gt;

    &lt;div class="form-group"&gt;
        &lt;div&gt;Social Security Number:&lt;/div&gt;
        &lt;input class="form-control" id="SSN" name="SSN" type="text" onfocus="emptyElement('status')" maxlength="9"&gt;
    &lt;/div&gt;

    &lt;p&gt;&lt;/p&gt;

    &lt;button type="submit" id="demographicsbtn"&gt;Insert Demographics Data&lt;/button&gt;
    &lt;span id="status"&gt;&lt;/span&gt;
&lt;/form&gt;
&lt;/div&gt;
&lt;?php
include('php_includes/footer.html');
?&gt;


Here is my validation and insert page:

&lt;?php
$page_title = 'Insert Demographics';
include('php_includes/header.html');

// Connect to the database
include_once("php_includes/db_connect.php");

// Gather the posted data into local variables
$mrn_demographics = mysqli_real_escape_string($db_connect, preg_replace('/[^a-zA-Z0-9]/', '', $_POST['mrn']));
$last_name        = mysqli_real_escape_string($db_connect, preg_replace('/[^a-zA-Z]/', '', $_POST['LastName']));
$first_name       = mysqli_real_escape_string($db_connect, preg_replace('/[^a-zA-Z]/', '', $_POST['FirstName']));
$ssn              = mysqli_real_escape_string($db_connect, preg_replace('/[^0-9]/', '', $_POST['SSN']));

// Get user IP Address
$ip = preg_replace('#[^0-9.]#', '', getenv('REMOTE_ADDR'));

// Form data error handling
if($mrn_demographics == "" || $last_name == "" || $first_name == "" || $ssn == ""){
echo "The form submission is missing data.";
exit();
} else {
// End form data error handling
$sql = "INSERT INTO nys_demographics (
    mrn,
    pt_last_name, 
    pt_first_name, 
    pt_ssn, 
    ip_address, 
    record_insert_dtime
)
VALUES('$mrn_demographics' ,'$last_name','$first_name','$ssn','$ip', 
now())";
}

if (mysqli_query($db_connect, $sql)) { 
  echo "&lt;h3&gt;Demographics have been inserted successfully, you will be auto-directed to the Injury Details form.&lt;br /&gt;&lt;br /&gt;&lt;/h3&gt;";
  echo "MRN: $mrn_demographics &lt;br /&gt;";
  echo "Last Name: $last_name &lt;br &gt;";
  echo "First Name: $first_name &lt;br /&gt;";
  echo "SSN: $ssn &lt;br /&gt;";
  echo "From IP Address: $ip &lt;br /&gt;";
  echo "On " .date("Y-m-d") ." at " .date("h:i:sa");
  header("refresh:3; url=injury_details.php");
} else {
  printf("Error: %s\n", mysqli_error($db_connect));
}

include('php_includes/footer.html');
?&gt;


I have a couple of questions:


Should my validation code be in a different PHP page or the same?
Could my validation be better and better written?


I want to echo out what has been input into the form.
You don't need to have your validation codes written in different page. But if you want to organize your code, you can go and separate your validation block.
Consider changing your validation. Your preg_replace is quite limiting. An example would be for names. Spaces, numbers, special characters are not allowed. Don't forget that there are names that has the mentioned above. It would work. Your validation could be written better if you want to increase security. There are tons of practice for validation of data and securing it for SQL query.
You could add some client side validation using HTML5 such as pattern, and required attribute.
You said you want to output what has been submitted in the form. Do you really need to output it in the validation/insertion page and then get redirected to the other page? You can instead put the details on sessions and head directly to the page you need to be and output what you have put on the sessions.
It is best to avoid putting PHP variables inside the quotation marks. "Your name is $name". Instead you can use {} to include it. "Your name is {$name}". However, it is recommended that you concatenate it instead "Your name is" . $name.
When including database page, it is also recommended to use require instead of include. This is to make the script stop upon error on getting the file.