I am using the following function for basic text fields on my form. I have looked up the ereg function and haven't been able to figure out the A-Za-z0-9 stuff too well. How do I allow the following entries to be made, yet have my system still safe from injections? Should I be using addslashes rather than this function?

desired entry examples:
1) first-run
2) O'Reiley

Thanks.

    // Validate text only
    function validateTextOnly($theinput,$description = ''){
        $result = ereg ("^[A-Za-z0-9\ ]+$", $theinput );
        if ($result){
            return true;
        }else{
            $this->errors[] = $description;
            return false; 
        }
    }

    Just do:

    if !get_magic_quotes_gpc()
    $field = pg_escape_string($field);

    BTW, preg is recommended over ereg.

      You should always use the correct escaping function for every string going into the database - even if you THINK that it will probably not contain any strings which you think need escaping.

      Validation is a separate topic and should be done on another level.

      Normally I'd say, use a system to automatically correctly escape strings - some sort of DB access layer like DB_DataObjects, or use prepared queries with PEAR DB (Although I'm not 100% convinced about that).

      If you try to add the code to correctly manually escape every string in your application into the database, you will fail. So don't do it.

      Mark

        It's trivially easy to handle escaping without bloating your code by adding an entire library.

          Write a Reply...