[RESOLVED] Security: how to check the values of checkboxes?

2005

This is my code:

<form...>
<input type='checkbox' value='1' name='speak_langs[]'>I speak English
<input type='checkbox' value='2' name='speak_langs[]'>I speak German
<input type='checkbox' value='3' name='speak_langs[]'>I speak French
<input type='checkbox' value='4' name='speak_langs[]'>I speak Spanish
<input type='checkbox' value='5' name='speak_langs[]'>I speak Swedish
...
</form>



mysql_query("UPDATE user_table SET speak_langs='" . mysql_escape_string(implode(", ", $speak_langs)) . "' where user_id='$id'");

Is there any way how to control the values of checkboxes?
For example, when user submits this form and he/she checked that he/she speaks English and Spanish... The script will insert into database:

1,4

That's correct.

But someone can create and submit a form like this:

<form action=myserver.com/submit.php>
<input type='checkbox' value='f**k off' name='speak_langs[]'>I speak English
<input type='checkbox' value='4' name='speak_langs[]'>I speak Spanish

In this case the script will insert into database:

f**k off, 4

I need some way to check that all values of checked boxes are only numbers between 1 and let's say 10.

It's easy if there is only 1 value and I can use for example is_numeric or something like that, but how to do it with checkboxes...?

Thank you.

Sayian

You can force the values to be an Integer by using a forcetype.


if($_POST) {

$langs = (INT) $_POST['langs'];

// $langs is now forced to be an integer, if the value is anything besides an integer the value will be made INTEGER 0


}

samudasu

You can create a function to loop through all the array values with each loop checking for certain requirements. This is untested and is just meant to give you an idea. Like this pseudo/real code:

function checkArray($arr)
{
    foreach($arr as $val) {
        if (variable $val doesnt fit my requirements) {
            $status = false;
            break;
        } else {
            $status = true;
        }
    }
return $status;
}


$result = checkArray($_POST['speak_langs']);
if (!$result) {
    something went wrong
    exit;
}

2005

Thank you for your replies! Samudasu, I created your suggested function and it works great. Now it checks if all values are numeric and at the same time it allows to process the form only when at least 1 ckeckbox is checked.

function checkArray($arr)
{

foreach($arr as $val) {

if (!is_numeric($val)) {

$status = false;
break;

} else {

$status = true;

}

}
return $status;
}