Security question

scialom

Hi all,

I have a problem with web form.
I have a basic form that ask for 5 differents fields.
When submitted I check the value to see if they are not empty:

$UserName = $_POST['username'];
if ($UserName==""){
   exit;
}

now when I test it the code works fine.
But I still get people who manage to by pass this and submit the form.
How can I overcome it?

Thanks,
Assaf

paulnaj

Hi Assaf,

Normally you would check if the $_POST array contains a key called 'username' (see the isset() function in the manual for details).

If it does exist, then check to see if the value associated with that key is empty.

...

<?php

if(!isset($_POST['username']) || $_POST['username'] ==''){
   die('[username] not sent.');
}

// Now you can be sure that $_POST['username'] does contain something
$UserName = $_POST['username'];

?>

Hope that helps, but there could still be issues in the part of the script that you haven't shown here.

NogDog

This would take care of people enterig only spaces:

$UserName = (isset($_POST['username'])) ? trim($_POST['username']) ? '';
if ($UserName==""){
   exit;
}

scialom

NogDog wrote:
This would take care of people enterig only spaces:
$UserName = (isset($_POST['username'])) ? trim($_POST['username']) ? '';
if ($UserName==""){
   exit;
}

this throw me an error:
Parse error: parse error, unexpected ';'

and what does the '?' does?

laserlight

NogDog made a typo error. It should be:

$UserName = (isset($_POST['username'])) ? trim($_POST['username']) : '';

Read up on the ternary operator for more information.

paulnaj

Gotta say that shortening code onto one line is for more experienced programmers!

Sometimes, to understand what's going on, you need to write it out in full, but that's enough preaching!!

Anyway, the '?' is part of what's called the ternary operator http://uk2.php.net/operators.comparison

Th error is just a typo ... the second '?' should be a ';'

Paul.

NogDog

paulnaj wrote:
Th error is just a typo ... the second '?' should be a ';'

Actually, it should be a ':'. :p

Once you get used to the ternary operator (and don't type it wrong), you'll find yourself using it all the time for that sort of thing. It's really quite simple, and is very similar to, for example, an IF function in SQL, where if the first value is true, you use the 2nd value, otherwise you use the 3rd:

IF(col1 = 5, 'value1', 'value2')

paulnaj

Doh!

After that sermon as well! :quiet: