Server Side Data Validation

Anon

I'm working on a project that requires server side data validation. We use JavaScript to do client side validation of things like e-mail addresses, date, numeric, alpha, etc. But since JavaSrcipt can be turned off we'd like to also check all data in PHP before inserting to or updating the database. Does anyone know of any good classes or function libraries that do some or all of this?

Anon

Dear Friend,

There is no real need to use classes of inbuilt functions. All you require to do is check whether the variable received is empty or not.

You can do this using if condition

e.g.

Variable names passed thru form : $fname, $lname

then the code can be:

if(!$fname)
$error="First name missing";
if(!$lname)
$error.="Last name missing";

if($error)
{
/ Statements to be executed if validation fails /
}
else
{
/ Statements if validation is successful /
}

KMH wrote:

Anon

Kartik,

This will work if I'm simply checking if the field was filled out, but I need to do a little stricter valiation. We need to validate the field type, format, size, etc. So let's say that lastname in my database is a varchar(25) then I would need to validate that it is really less than 25 and if not produce an error message for the user. Our application has about 45 entry forms each with (25-50) fields. So I was thinking that using something modular will be easier to maintain than coding over 1000 individual field validations. Since the valdation can be broken into a smaller amount of general validation rules. Currently our app is written as a C++ cgi with HTML templates, Oracle 8i backend and we are working on porting it to PHP for speed and faster development. PHP will give us the ability to rapidly add features and extend the app.

Anon

I'm not aware of any generic libraries that do this, but
it wouldn't be too hard to write your own:

$errmsg = validate_string( $name, 1, 20 ); // len must be between 1~20
$errmsg .= validate_email( $email );
$errmsg .= validate_numeric ($age, 18, 65 );
$errmsg .= validate_regex( $zipcode, '[0-9]{5}');

You get the idea: every validation function takes a value parameter
to be check along with the restrictions (e.g. min and max string length)
if any (e.g. in checking for a valid email address the criteria can be
hidden in the function itself.) validate_regex() provides a catchall
that can be as useful as your regex ability :-)

Each of the functions returns an error string, which can be concatenated
together as you perform the checks. A useful variant of this is to
provide a parameter for the error message (defaulted to a generic
message) so that you can be more specific:

$errmsg = validate_string( $name, 1, 20, "Name must be 20 chars or less" );