[RESOLVED] Frustrating if statement!

benbox

Hey!

I've spent like an hour messing about with this, but can't seem to get what I want.. even though it seems soooo simple.. I've currently whats below.. but what I'm trying to achieve is, get a statement to return TRUE if..

the input is NOT an integer,
or the input is negative,
or the input is not set (it's coming from a form, if it's blank but still submitted I assume it's going to have a value of ""? i.e. meaning it is set, but just doesn't have a value..

if( $_POST['var'] < 0 || (!is_int($_POST['var']) && $_POST['var'] != 0) ) {
}

Please help 😕 It seems SO simple.. but I'm having trouble with it, lol

benbox

Just to add.. I've got this working to find negatives, unset and non-ints.. the only case where it is NOT working is if $var == 0.. as it should return false for this.. how can I add that into this?

if( $var < 0 || !is_int($var) || $var == null ) {
}

laserlight

One way is to think of what should be allowed, then negate it:

if (!(isset($_POST['var']) && ctype_digit($_POST['var']) && $_POST['var'] >= 0))

halojoy

hi
Try this.
It might work!

<?php

$res = FALSE;
if( !isset($_POST['var']) || empty($_POST['var'])
|| $_POST['var'] < 0 || !is_int($_POST['var']) ) {
$res = TRUE;
}

if ( $res ) echo 'TRUE';
else echo 'FALSE';

?>

laserlight

Dont use is_int() here. $_POST['var'] simply will never be an int. There is no need to use both isset() and empty(), pick one.

benbox

Ooh, I like your way of thinking laserlight.. much more logical! lol

Although I just played about with that for a few minutes.. firstly just to check it worked using my own variable offline simply as $var.. and didn't work, almost posted here saying so..

but it does when using $_POST.. confused me a lil but I guess there is some logic to that too..

Thanks! 😃

Houdini

You need to use $_POST['var'] instead of $var because the server you are using has register_globals turned off like they should be and have been for quite a while. Read the below from the PHP Manual

Chapter 29. Using Register Globals
Perhaps the most controversial change in PHP is when the default value for the PHP directive register_globals went from ON to OFF in PHP 4.2.0. Reliance on this directive was quite common and many people didn't even know it existed and assumed it's just how PHP works. This page will explain how one can write insecure code with this directive but keep in mind that the directive itself isn't insecure but rather it's the misuse of it.

When on, register_globals will inject your scripts with all sorts of variables, like request variables from HTML forms. This coupled with the fact that PHP doesn't require variable initialization means writing insecure code is that much easier. It was a difficult decision, but the PHP community decided to disable this directive by default. When on, people use variables yet really don't know for sure where they come from and can only assume. Internal variables that are defined in the script itself get mixed up with request data sent by users and disabling register_globals changes this. Let's demonstrate with an example misuse of register_globals:

Source is PHP Manual

benbox

The $var I mentioned was just within the file itself.. so I'd put $var = 5; immediately above the code we've been talking about, and I just changed the $_POST stuff to $var to test it quickly..

but this really is forcing me to use $POST, $GET and $_SESSION a lot more.. it's more effort, but at least you're more aware of whats happening!

I've not read that page in the manual though, so I'll have a read! thanks!