Re: Sanity check on form validation code

Hi, This looks good for validation, except for something that i want to mention! The first thing is not a 'problem' : but $errorCount = 0; would have been great! (Instead of initializing it as if it was string) On your test_input function: The combination of stripslashes and htmlspecialchars (called in this way) may increase your vulnerability on SQL injection (if you are using this form to do tasks on the database). Although the filter_var does some work, it is advisable to use parameterized queries if you are planning to do some works on the database! -- cipher fb/twitter/github: nootanghimire On सोमबार 17 मार्च 2014 08:53 पूर्वाह्न, David Mehler wrote:

Hello, I've got a form with various fields. One is a text input field called name with a size and a maxlength of 30. I've got the following validation code for this field. I'd appreciate feedback on it before I do the others. Thanks. Dave. $contact_page_errors = array(); $errorCount = ""; $name = ""; function test_input($data) { $data = trim($data); $data = stripslashes($data); $data = htmlspecialchars($data); return $data; } // Validate the name field if (empty($_POST["name"]))

     {

$contact_page_errors['name'] = "Name is Required"; $errorCount++; } else

     { // trims, strips slashes, and runs through htmlspecialchars

$name = test_input($_POST["name"]); // Field should be at least two characters maximum of 30 and non-numeric if (!strlen($name <= 2)) {

       $contact_page_errors['name'] = "Name must have at least two characters\n";

$errorCount++; } if (strlen($name > 30)) {

       $contact_page_errors['name'] = "Name can not have more than 30

characters\n"; $errorCount++; } if (is_numeric($name)) {

       $contact_page_errors['name'] = "Name can not be numeric\n";

$errorCount++; } }

     // check if name only contains letters and whitespace

if (!preg_match("/^[A-Z][a-zA-Z -]+$/",$name)) {

       $contact_page_errors['name'] = "Name must be from letters,

dashes, spaces, first letter uppercase, and must not start with dash.\n"; $errorCount++; } // Use php's filter_var to sanitize what's left $name = filter_var($name, FILTER_SANITIZE_STRING); } // end of name checks