Form validation...

[Teach]

Hello.

I'm setting up a quick form for a bot lending organisation (IRC)...and just wondered if you could clarify the following validation for me please.

if (!preg_match("/^#[A-Za-z0-9].*$/",$_POST['CHANNEL')) {
    $msg .= "<li>The channel must begin with # followed by a letter or a number.</li>\n";
}

$badlist[0]="warez";
$badlist[1]="vivo";
$badlist[2]="password";
$badlist[3]="mp3";
$count=count($badlist);
for ($x=0;$x<$count;$x++) {
if (ereg("" . strtolower($badlist[$x]) . "",strtolower($_POST['CHANNEL')) ) {
    $msg .= "<li>Your channel contains a name prohibited by our terms.</li>\n";
    }
}

Ending with:

if (!empty($msg)) {
    include_once('/home/us/header.php');
      echo "<p>Errors...</p>\n<div class=\"messagebox\">\n<ul>\n$msg\n</ul>\n</div>\n";
    include_once('/home/us/footer.php');
    exit();
}

Thanks.

[bpat1434]

What do you want to know?

The preg_match() looks to see if the channel name is in the following format:
"#" followed by any number of text/numeric characters, but NO symbols. What they are doing is if preg_match() fails (or equates to FALSE) then do what's within the if() brackets.

#chat <-- fulfulls preg_match()
#blah0189 <-- fulfulls preg_match()
#na&ane <-- doesn't match

So, your code basically says:

If the preg_match() equates to false, set the $msg variable to a string which states why. Set the $badlist array. $badlist are channel names that are prohibited. The for() loop takes the length of $badlist array and for each item in the $badlist array, If $_POST channel is equivilant to the $badlist array item, then ereg equates to TRUE and sets the $msg variable.

Later in the code, it checks to see if $msg is empty, if not, then it displays the error and exits.

Now, the whole for(if(ereg("".strtolower....) stuff can possibly be circumvented with a simple:

if(in_array($_POST['CHANNEL'], $badlist))
{
    $msg .= blah blah blah;
}

~Brett

[kburger]

I thought the original code was a little kludgy myself. But I think the modification needs another slight modification since in_array() compares strings in a case-sensitive manner.

if(in_array($_POST['CHANNEL'], $badlist))
{
    $msg .= blah blah blah;
}

to

if(in_array(strtolower($_POST['CHANNEL']), $badlist))
{
    $msg .= blah blah blah;
}

[bpat1434]

Good catch.

I would also possibly say that if the $_POST['CHANNEL'] includes the "#" sign, then your $badlist would also have to include that.

~Brett

[kburger]

Also a good catch. Maybe he should stick with the original code. Maybe the coder knew what he was doing. 😃

[bpat1434]

Nah, I think the coder made it too complex than it really needed to be. Plus, that's a catch from the original code, as it were.

~Brett

[Teach]

Thanks for your kind replies.

How would the end code look with the changes mentioned above?

Something like.....

if (!preg_match("/^#[A-Za-z0-9].*$/",$_POST['CHANNEL')) {
    $msg .= "<li>The channel must begin with # followed by a letter or a number.</li>\n";
}

$badlist[0]="warez";
$badlist[1]="vivo";
$badlist[2]="password";
$badlist[3]="mp3";
$count=count($badlist);
for ($x=0;$x<$count;$x++) {
if(in_array(strtolower($_POST['CHANNEL']), $badlist)) {
    $msg .= "<li>Your channel contains a name prohibited by our terms.</li>\n";
    }
}

?

[bpat1434]

Take the $count and for() loops out.

if (!preg_match("/^#[A-Za-z0-9].*$/",$_POST['CHANNEL')) {
    $msg .= "<li>The channel must begin with # followed by a letter or a number.</li>\n";
}

$badlist[0]="#warez";
$badlist[1]="#vivo";
$badlist[2]="#password";
$badlist[3]="#mp3";

if(in_array(strtolower($_POST['CHANNEL']), $badlist)) {
    $msg .= "<li>Your channel contains a name prohibited by our terms.</li>\n";
}

~Brett

[tekky]

well I'm sure they were using ereg() because they didnt want hte badlist anywhere IN the name ie..

#this_is_warez == bad
#socalwarez == bad
#worldwarezprovider == bad

etc etc

you oculd replace the ereg() with a a [man]strpos/man or [man]stripos/man

[Teach]

Hi there.
Thanks for the replies. 🙂

Little bit confused here... so if I was to use this code:

if (!preg_match("/^#[A-Za-z0-9].*$/",$_POST['CHANNEL')) {
    $msg .= "<li>The channel must begin with # followed by a letter or a number.</li>\n";
}

$badlist[0]="#warez";
$badlist[1]="#vivo";
$badlist[2]="#password";
$badlist[3]="#mp3";

if(in_array(strtolower($_POST['CHANNEL']), $badlist)) {
    $msg .= "<li>Your channel contains a name prohibited by our terms.</li>\n";
}

Why would I need the "#"'s in the badlist like has been done above? We didn't have those before. Are they required?

has to be given as the first character before any number/letter hence the first validation, then any of the input containing those words would be banned, so even if it was #sjdkskwarezsjkdsjks (without bold just to show it clearly) that would be prohibited.

Thanks!

[bpat1434]

Well in that case no. And you should take the last portion that I changed, and go back to the ereg in that case. Otherwise, anything will be allowed, even if the badlist word is in it.

~Brett