note 60613 added to function.strlen

Sometimes you really wanna make sure no user edits the 'maxlength' attribute of the HTML page and POSTs a 5 Mb string to your script. Probably, advanced programmers already take precautions, this one is just a very simple tip for beginners on how to check the character lenth of the POST variables in an effective manner. <?php // ALWAYS clean the POST variables of any HTML tags first. // And here we do it in one easy step. $_POST = array_map('strip_tags', $_POST); // These are the POST variables in the example $alias = $_POST['alias']; $name = $_POST['name']; $status = $_POST['status']; $year = $_POST['year']; // We create an array that contains the expected character length // for each POST variable $exlen = array ( 'alias'=>12, 'name'=>30, 'status'=>10, 'year'=>4 ); // Now check if any of them exceeds the expected length foreach ($exlen as $key=>$val) { if (strlen($$key) > $val) { // The user has definitely edited the HTML! He has a lot of time, could be bad. // This section can edited according to your needs - very simple to complex. // Log the event or send an e-mail to the admin at the basic. // However, in this example we just print a warning. print 'WARNING: The FBI is looking for you, dude!'; exit; // The best part is that the script won't look for any other // POST variables other than the ones which we are expecting already. } } ?> Similarly, with the use of Regular Expressions you could check the data type and string format too. ---- Manual Page -- http://www.php.net/manual/en/function.strlen.php Edit -- http://master.php.net/manage/user-notes.php?action=edit+60613 Delete: added to the manual -- http://master.php.net/manage/user-notes.php?action=delete+60613&report=yes&reason=added+to+the+manual Delete: bad code -- http://master.php.net/manage/user-notes.php?action=delete+60613&report=yes&reason=bad+code Delete: spam -- http://master.php.net/manage/user-notes.php?action=delete+60613&report=yes&reason=spam Delete: useless -- http://master.php.net/manage/user-notes.php?action=delete+60613&report=yes&reason=useless Delete: non-english -- http://master.php.net/manage/user-notes.php?action=delete+60613&report=yes&reason=non-english Delete: already in docs -- http://master.php.net/manage/user-notes.php?action=delete+60613&report=yes&reason=already+in+docs Delete: other reasons -- http://master.php.net/manage/user-notes.php?action=delete+60613&report=yes Reject -- http://master.php.net/manage/user-notes.php?action=reject+60613&report=yes Search -- http://master.php.net/manage/user-notes.php