Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.lang.php > #7728

Re: Simpler way to validate form fields?

Show all headers | View raw

Am 05.12.2012 11:36, schrieb Gilles:
> On Wed, 05 Dec 2012 10:56:24 +0100, "M. Strobel"
> <sorry_no_mail_here@nowhere.dee> wrote:
>> Too basic. My user input reader is
>>
>> function getStringFromForm($key, $l=255, $val=null) {
>>    return (isset($_REQUEST[$key])) ?
>>          filter_var(substr($_REQUEST[$key],0,$l), FILTER_SANITIZE_STRING) :
>>          $val;
>> }
>>
> [...]
>> I read $_REQUEST, because the first thing my dispatcher does is a check for GET/POST,
>> and POST form values can be as easily manipulated as get values. So EVERY string
>> input uses this function.
> 
> Thanks much for the code. I'm not sure I understand what you mean
> about checking for GET/POST. Do you mean this?
> 
> ============
> if ($_SERVER['REQUEST_METHOD'] === 'POST') {
>     //Call getStringFromForm, getEmailFromForm, and getIntFromForm
> 	//for each form field
> }
> ============
> ?

Yes. The idea is to read only expected data.

Then the idea is to have your input filter adjusted in one place if it fails somehow.

This must be coupled with prepared statements for the database insert (against SQL
injection), and a output filter that converts special chars to entities (against XSS).

That's about it.

/Str.

Back to comp.lang.php | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

Simpler way to validate form fields? Gilles <nospam@nospam.com> - 2012-12-04 23:37 +0100
  Re: Simpler way to validate form fields? "Beauregard T. Shagnasty" <a.nony.mous@example.invalid> - 2012-12-04 23:44 +0000
    Re: Simpler way to validate form fields? Jerry Stuckle <jstucklex@attglobal.net> - 2012-12-04 19:04 -0500
  Re: Simpler way to validate form fields? Jerry Stuckle <jstucklex@attglobal.net> - 2012-12-04 19:07 -0500
    Re: Simpler way to validate form fields? Gilles <nospam@nospam.com> - 2012-12-05 11:32 +0100
    Re: Simpler way to validate form fields? "M. Strobel" <sorry_no_mail_here@nowhere.dee> - 2012-12-05 12:49 +0100
  Re: Simpler way to validate form fields? "M. Strobel" <sorry_no_mail_here@nowhere.dee> - 2012-12-05 10:56 +0100
    Re: Simpler way to validate form fields? Gilles <nospam@nospam.com> - 2012-12-05 11:36 +0100
      Re: Simpler way to validate form fields? "M. Strobel" <sorry_no_mail_here@nowhere.dee> - 2012-12-05 11:52 +0100
      Re: Simpler way to validate form fields? "M. Strobel" <sorry_no_mail_here@nowhere.dee> - 2012-12-05 12:09 +0100
        Re: Simpler way to validate form fields? Gilles <nospam@nospam.com> - 2012-12-06 14:43 +0100
          Re: Simpler way to validate form fields? Gilles <nospam@nospam.com> - 2012-12-06 14:55 +0100
            Re: Simpler way to validate form fields? "M. Strobel" <sorry_no_mail_here@nowhere.dee> - 2012-12-06 17:50 +0100
              Re: Simpler way to validate form fields? Gilles <nospam@nospam.com> - 2012-12-06 17:51 +0100
            Re: Simpler way to validate form fields? Gilles <nospam@nospam.com> - 2012-12-06 17:50 +0100
              Re: Simpler way to validate form fields? "M. Strobel" <sorry_no_mail_here@nowhere.dee> - 2012-12-06 17:55 +0100
                Re: Simpler way to validate form fields? Gilles <nospam@nospam.com> - 2012-12-07 11:15 +0100
                Re: Simpler way to validate form fields? "M. Strobel" <sorry_no_mail_here@nowhere.dee> - 2012-12-07 11:56 +0100

csiph-web