[Resolved] input validation

[bampot]

i'm looking to validate user input on a shopping cart, firstly to avoid negative numbers being used on quantities, and secondly to have a minimum length on a search query so searches for 'a' dont return massive results.

thanks in advance

[cosminb]

if ($quantity < 0)
{
 .....
}

if (mysql_num_rows(...))
{
 .....
}

[bampot]

thanks
i have tried to implement that with the script but i need some help to make it work

function display_cart($cart, $change = true, $images = 1)
{
  // display items in shopping cart
  // optionally allow changes (true or false)
  // optionally include images (1 - yes, 0 - no)

  global $_SESSION;

  echo '<table border = 0 width = 100% cellspacing = 0>
        <form action = show_cart.php method = post>
        <tr><th colspan = '. (1+$images) .' bgcolor="#cc66cc">Item</th>
        <th bgcolor="#cc66cc">Price</th><th bgcolor="#cc66cc">Quantity</th>
        <th bgcolor="#cc66cc">Total</th></tr>';

  //display each item as a table row
  foreach ($cart as $code => $qty)
  {
    $product = get_product_details($code);
	if ($qty < 0)
	{
	 echo '';
	}
	else
     echo '<tr>';
     if($images ==true)
     {
       echo '<td align = left>';
       if (file_exists("images/$code.jpg"))
       {
          $size = GetImageSize('images/'.$code.'.jpg');  

          if($size[0]>0 && $size[1]>0)
          {
            echo '<img src="images/'.$code.'.jpg" border=0 ';
            echo 'width = '. $size[0]/3 .' height = ' .$size[1]/3 . '>';
          }
       }
       else
          echo '&nbsp;';
       echo '</td>';
     }
     echo '<td align = left>';
     echo '<a href = "show_product.php?code='.$code.'">'.$product['description'].'</a> from '.$product['product_group'];
     echo '</td><td align = center>£'.number_format($product['price_each'], 2);
     echo '</td><td align = center>';
     // if we allow changes, quantities are in text boxes
     if ($change == true)
       echo "<input type = text name = \"$code\" value = \"$qty\" size = 3 maxlength='3'>";
     else
       echo $qty;
     echo '</td><td align = center>£'.number_format($product['price_each']*$qty,2)."</td></tr>\n";
   }
   // display total row
   echo '<tr>
           <th colspan = '. (2+$images) ." bgcolor=\"#cc66cc\">&nbsp;</td>
           <th align = center bgcolor=\"#cc66cc\"> 
               ".$_SESSION['items']."
           </th>
           <th align = center bgcolor=\"#cc66cc\">
               £".number_format($_SESSION['total_price'], 2).
           '</th>
         </tr>';
   // display save change button
   if($change == true)
   {
     echo '<tr>
             <td colspan = '. (2+$images) .'>&nbsp;</td>
             <td align = center>
               <input type = hidden name = save value = true>  

               <input type = image src = "images/layout/save-changes.gif" 
                      border = 0 alt = "Save Changes">
             </td>
             <td>&nbsp;</td>
         </tr>';
   }
   echo '</form></table>';
}

[cosminb]

I don't think I know exactly want you want to do ... I think you should check if $qty is bigger than 0 when you add the products to your shopping cart(or change the contents) not when you are displaying the products.

[TTT]

where is the problem, do you get some error? what does this function do: $product = get_product_details($code);

if(count($cart) != 0) {
  foreach ($cart as $code => $qty)   { 
       $product = get_product_details($code); 
    if ($qty >= 0)   { 
      echo '<tr>'; 
    .....

[bampot]

i've got it, it was the code in show_cart.php which calls the display_cart() function. it previously checked if the $qty was equal to zero before unsetting

  if(isset($_POST['save'])) 
  {
    foreach($_SESSION['cart'] as $code => $qty)
	{
	  if($_POST[$code]<='0') // amended
	    unset($_SESSION['cart'] [$code]);
	  else
	    $_SESSION['cart'] [$code] = $_POST[$code

seems to be working now
thanks for your help : )