note 60613 deleted from function.strlen by hholzgra

Note Submitter: Hage Yaapa ---- Sometimes you really wanna make sure no user edits the 'maxlength' attribute of the HTML page and POSTs a 5 Mb string to your script. Probably, advanced programmers already take precautions, this one is just a very simple tip for beginners on how to check the character lenth of the POST variables in an effective manner. <?php // ALWAYS clean the POST variables of any HTML tags first. // And here we do it in one easy step. $_POST = array_map('strip_tags', $_POST); // These are the POST variables in the example $alias = $_POST['alias']; $name = $_POST['name']; $status = $_POST['status']; $year = $_POST['year']; // We create an array that contains the expected character length // for each POST variable $exlen = array ( 'alias'=>12, 'name'=>30, 'status'=>10, 'year'=>4 ); // Now check if any of them exceeds the expected length foreach ($exlen as $key=>$val) { if (strlen($$key) > $val) { // The user has definitely edited the HTML! He has a lot of time, could be bad. // This section can edited according to your needs - very simple to complex. // Log the event or send an e-mail to the admin at the basic. // However, in this example we just print a warning. print 'WARNING: The FBI is looking for you, dude!'; exit; // The best part is that the script won't look for any other // POST variables other than the ones which we are expecting already. } } ?> Similarly, with the use of Regular Expressions you could check the data type and string format too.