Input validation (the right way)

Posted: Wed Nov 26, 2008 4:07 pm

So i see a lot of newbies trying to figure out all the good things of POST and other input data.
The magic is easy but who did actually what i did?

POST
This one is easy.

Is the key posted?

Code:

isset($_POST['key'])

What kind of data should it contain: float, signed int, unsigned int, text, xhtml, other?

At #2 it gets tricky since everything is a string (or array) at first.

signed int

Code:

preg_match('#^-?\d+$#', $_POST['key'])

unsigned int

Code:

ctype_digit($_POST['key'])

float

Code:

preg_match('#(-?[0-9,]+)?(\.([0-9]+))?$|(-?[0-9\.]+)?(,([0-9]+))?$#D', $_POST['key'])

text (To output the data use htmlspecialchars() at the output level for any text string)

Code:

$_POST['key'] = strip_tags($_POST['key'])

xhtml can be validated in many ways, including tidy_repair_string()

Code:

$_POST['key'] = tidy_repair_string($_POST['key'], array('output-xhtml'=>1,'show-body-only'=>1,'newline'=>'LF'), 'ISO-8895-1');

FILES

Take a look at Only registered users can see links on this board! Get registered or login!

Hope it helps!

Site Admin/Owner Joined: Aug 27, 2002 Posts: 17088

Thanks DJM Smile