Second Post, Please Help!: Validating Form Data

Anon

I'm posting this again because I cannot get this to work, and I really need someone's help.

I'm trying to validate form data in the $HTTP_POST_VARS array, and everything works o.k. except when I check certain fields to see if they are numbers. Here is my routine:

the $fields is an array passed in that holds the names of form fields that should be
numbers. I don't really need the $key, just the $val to match it against the data from the POST. Even when I put numbers in the form fields and submit them, every field comes back invalid. I have also tried using is_long() and is_double() with the same results. I've also tried adding () in case I have a precedence problem.

Also, i couldn't get the the is_long(),is_double(), and gettype() functions to work directly on the HTTP_POST_VARS array, like is_int( $HTTP_POST_VARS[$val] ), so I set the $temp variable. Anyone know why this doesn't work?

                    TIA 
                    Brian

Anon

If you're using php4, Try is_numeric()
http://www.zugeschaut-und-mitgebaut.de/php/function.is_numeric.html

echo validate_numbers($HTTP_POST_VARS, array('one', 'two'));

function validate_numbers($postvars, $fields)
{
foreach($fields as $key => $value) {
if (in_array($key, $postvars) AND !is_numeric($postvars[$key])) $errors .= "Field $val must be a number<br>";
}
return $errors;
}

Anon

Just a note, it's usually better to specify what's allowed, rather than what's not allowed, when validating.

It's kind of like trying to prove a negative, you can't do it.

Here are a few examples:

If you want only letters in the form field you can write something like:

if( ereg('^[a-zA-Z]+$', $this->name) )

If this matches your string then you know you've got only letters.

Or, you can extend this to match only letters, numbers, the period, the dash and the underscore. (add characters as you wish)

if( ereg('^{[a-zA-Z._0-9-]+$',} $this->name) )

If this matches then I know I've got a safe file name without wierd or dangerous escaped strings. Should I use this in a system call or something, (actually don't know why I would but...) there won't be anything nasty in the string.

matt.

Anon

Thanks for your help. To clarify, an empty field would not match because your regex requires one or more of those char.classes, is that correct? I'm a somewhat knew to regular expressions.

I definitely like your idea better, looking for what should be there rather than seeing if they are empty.
Brian

Anon

Does the filename for a file to be uploaded get stored as a value in HTTP_POST_VARS? It doesn't seem to on latest build for Win32, didn't know if this was a bug or intentional.

I'm trying to avoid the auto creation of variables for more speed since I run in cgi mode.

Brian

Anon

the user's filename for the file is stored in userfile_name where userfile is the name of the file form field in your html.

i don't know if it's also stored in the post vars array.

Anon

if your string should be in $field you can just do:

if($string)
{
//then do ereg...
}
else
{
//no string was entered...
}

Then you'll know if the field was empty.

PHP considers and unset or empty variable to be a false boolean value much like Java or Javascript.

Anon

I'm sorry, I should have written: (it's early)

if your string should be in $field you can just do:

if($field)
{
//then do ereg...
}
else
{
//no string was entered...
}

Then you'll know if the field was empty.

PHP considers an unset or empty variable to be a false boolean value much like Java or Javascript.

Anon

Is there any way to do this with PHP3?

Thanks!

Anon

you might try get_type()

I'm not sure if it's available in php3 but you could try it out.

or you could try set_type().
if you tried to set the variable to an integer and it was numeric then set_type would return true.

http://www.php.net/manual/function.settype.php

matt.