[RESOLVED] checking for non integer values

182x

Hi guys, I currently have the following code which checks for a NULL value but I also need to ensure that the value is not an integer I was just wondering how to check for this?

if($Id == NULL || //need to check for non integer value)

bradgrafelman

[man]is_int/man.

Also, be careful in doing the NULL comparison:

$test = 0;
if($test == NULL) echo "NULL?"; // outputs NULL?
if($test === NULL) echo "Definitely NULL."; // no output

182x

tried is_int() but had no luck just managed to solve it with the following code, does that seem like a good method or could there be problems with it?

I was also wondering what is the '===' operator?

Thanks.

if (empty($problemId) || !is_numeric($problemId))

bradgrafelman

It compares type and value rather than just value. For more information, see this manual page: [man]language.operators.comparison[/man].

Also, you've got the same problem still; a value of 0 is considered "empty."

And yeah, you're probably validating form inputs or something like that, which are always passed as strings. In that case, you'd have to use [man]is_numeric/man which is specifically designed to examine strings and determine if their values are numeric or not. Note that is_numeric() also allows hexadecimal numbers, so if you strictly want to know if the string is an integer (and not a decimal, in which case you could use [man]ctype_digit/man), you could do something like:

if((int)$problemId.'' === $problemId.'')

182x

Thanks problemId is the promary key so I was just checking it because if the user entered a character by mistake the db produced an error.

Is my method ok for this as I think primary keys always start at 1 or am I best using your method?

Thanks.

bradgrafelman

Well like I said, if someone entered a hexadecimal string in for the ID then is_numeric() would say that it's numeric (since it is), though SQL would probably cough and die.

Normally, I don't even bother checking the value passed since I just cast it to an integer before I use it in a query, but I suppose you might be able to save the DB a query or two where some lame script-kiddie is attempting to alter the URL (or however these ID's are passed) to mess with your scripts. shrug

NogDog

I would probably do something like:

$problemId = trim($_POST['problemId']); // get rid of leading/trailing white space
if(!ctype_digit($problemId))
{
   // invalid value
}

182x

Thanks again guys,

I tested my method again and entered a hex string and it still worked is this another underpinning problem?

laserlight

What did you try? The only way for it to still "work" would be if you used ctype_xdigit() instead of ctype_digit(), by some accident.

182x

Sorry I am confused now, I entered a Hex string and used the following code to check it so that it would only process if the value is not a character so the IF filters out the characters and if its a number the else will continue to process.

However the hex still didn't seem to cause any problems.

if (empty($problemId) || !is_numeric($problemId))

laserlight

You should read bradgrafelman's post again: "Well like I said, if someone entered a hexadecimal string in for the ID then is_numeric() would say that it's numeric (since it is), though SQL would probably cough and die."

Use ctype_digit() instead of is_numeric().

bradgrafelman

And the only reason I mention SQL not liking the hex numbers is because whenever I pass SQL a numeric value, I don't use quotes (just like in PHP).

EDIT: So I don't know why I thought MySQL wasn't smart enough to handle hexadecimals, because it can. In other words, even if you entered a hexedecimal, it probably wouldn't break your SQL query.