Setting Up Form Field Validation in 1C-Bitrix

We encounter this constantly. Clients arrive with a ready-made contact catalog where each manager entered data however they wanted. As a result, no automatic export works. The solution is to set up validation at the form filling stage. Here we show how to bring order to data using 1C-Bitrix tools: from input masks to server handlers. Our experience — over 50 validation projects, each delivered turnkey with a guaranteed result. Validation setup starts from $200 per form and reduces erroneous records by up to 90%. For a typical 5-field form, investment ranges from $300 to $500, eliminating thousands in manual data cleaning costs annually.

The form accepts a phone number in any format: "80291234567", "+375-29-123-45-67", "029 123 45 67" — all of it lands in the database as is. Three months later, a manager looks at 2000 records with numbers in ten different formats and cannot upload them to the CRM. If validation had been set up in advance, the data would have arrived normalized. Let's examine the tools that ensure this.

Why Standard Validation Is Not Enough

1C-Bitrix's built-in tools provide basic checks but do not solve all problems. They cannot flexibly respond to non-standard formats, do not normalize data, and do not protect against bots. For full-featured validation, you need to combine several approaches: from masks to server-side handlers. According to 1C-Bitrix documentation, the OnBeforeResultAdd event is the primary point for server-side validation.

Step-by-Step Validation Setup

1. Analyze form fields – Identify which fields need validation (phone, email, date, etc.) and their required formats.
2. Choose validation methods – Decide on client-side masks, JavaScript validation, and server-side checks. For example, phone fields often use both a mask and a server regex.
3. Implement client-side validation – Add input masks with IMask.js and JavaScript submit handlers for instant feedback.
4. Write server-side handlers – Use OnBeforeResultAdd to normalize data and reject invalid entries.
5. Test with boundary values – Test with direct POST requests, empty fields, and extreme inputs to ensure robustness.

Built-in Validation of the Form Module

The form module supports basic validation at the field level via parameters in b_form_field: the REQUIRED (Y/N) field, the CHECK_FILTER field — a regular expression for value checking, and the FILTER_MEMO field — an error message.

Editing via API:

\CFormField::Update($fieldId, $formId, [ 'REQUIRED' => 'Y', 'CHECK_FILTER' => '^\\+375[0-9]{9}$', 'FILTER_MEMO' => 'Enter the number in the format +375XXXXXXXXX', ]); 

CHECK_FILTER is checked on the server when the result is saved. Client-side validation is not supported by the built-in module — only server-side.

Comparison of Validation Approaches

An input mask catches typos 5 times faster than a server-side check after submission. However, only server-side validation guarantees protection against direct POST requests.

Common Field Validation Patterns

Client-Side Validation via JavaScript

For immediate feedback, front-end validation is added to the template of the bitrix:form.result.new component. The handler subscribes to the form submit event:

document.getElementById('form_<?= $arResult['FORM']['SID'] ?>').addEventListener('submit', function (e) { var errors = []; // Phone var phone = document.getElementById('field_PHONE').value.replace(/\D/g, ''); if (!/^375\d{9}$/.test(phone)) { errors.push('Phone: enter the number in the format +375XXXXXXXXX'); document.getElementById('field_PHONE').classList.add('error'); } // Email var email = document.getElementById('field_EMAIL').value; if (email && !/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(email)) { errors.push('Email: invalid address format'); document.getElementById('field_EMAIL').classList.add('error'); } if (errors.length > 0) { e.preventDefault(); document.getElementById('form_errors').innerHTML = errors.join('<br>'); } }); 

Normalization Before Saving

Validation without normalization is a half solution. The phone number should not only be checked but also brought to a unified format. Handler for the OnBeforeResultAdd event:

AddEventHandler('form', 'OnBeforeResultAdd', function($formId, &$arFields) { if (isset($arFields['form_field_PHONE'])) { $phone = preg_replace('/\D/', '', $arFields['form_field_PHONE']); // Normalize: 80291234567 → 375291234567 if (strlen($phone) === 11 && $phone[0] === '8') { $phone = '375' . substr($phone, 2); } if (strlen($phone) === 9) { $phone = '375' . $phone; } if (strlen($phone) === 12 && str_starts_with($phone, '375')) { $arFields['form_field_PHONE'] = '+' . $phone; } else { global $APPLICATION; $APPLICATION->ThrowException('Invalid phone number format'); return false; } } }); 

Validation Using Input Masks

An input mask prevents incorrect format during input. The IMask.js library is integrated into the component template:

IMask(document.getElementById('field_PHONE'), { mask: '+{375} (00) 000-00-00', }); 

With the mask, the user physically cannot enter a letter in the phone field. This removes part of the load from back-end validation, but does not replace it — data can come via a direct POST request bypassing the form.

Spam Protection

Bitrix's standard CAPTCHA is enabled via the component parameter USE_CAPTCHA. For web forms, use a field of type captcha in b_form_field. An alternative is Google reCAPTCHA v3 via the OnBeforeResultAdd handler: with a low reCAPTCHA score, the form is silently rejected (honeypot approach for bots). Our implementations show spam reduction of up to 95%.

Server-side reCAPTCHA v3 check:

$token = $_POST['g-recaptcha-response']; $response = file_get_contents( 'https://www.google.com/recaptcha/api/siteverify?secret=SECRET&response=' . $token ); $data = json_decode($response, true); if ($data['score'] < 0.5) { return false; // Silently reject } 

Deliverables

Our specialists, with over 10 years of experience with 1C-Bitrix, perform a full analysis of the form, develop regular expressions and masks, configure server handlers and spam protection. Everything is tested on real scenarios. Upon completion, you receive documentation and an administrator's guide. We guarantee that data will come in a unified format and erroneous records will be minimized to <1%.

What You Get

• Analysis: Review of current fields and data requirements
• Development: Regular expressions and masks for each field
• Implementation: Front-end validation (JavaScript) and back-end handlers
• Anti-spam: Integration of reCAPTCHA v3 or custom honeypot fields
• Testing: Boundary value testing and direct POST request verification
• Deliverables:
  • Validation specification document
  • JavaScript code for front-end validation
  • PHP handlers for server-side normalization
  • reCAPTCHA v3 integration code
  • Test report with before/after error rates
  • Administrator's guide (PDF)
  • Training session for your team (1 hour)
  • Access to our support portal for issue tracking
  • 1 month post-launch support

How Long Does Setup Take?

Timelines depend on the number of fields and complexity of logic. On average, configuring one field takes from 2 hours; comprehensive validation of a form (up to 10 fields) takes 2 to 5 days. Project estimation is free. Contact us to discuss details and choose the best solution for your business.

Common edge cases: leading/trailing spaces, characters in numeric fields, empty required fields. These are caught by trimming spaces before server validation and setting appropriate regex patterns.