In effect your code is more likely to look like this:
PHP Code:
if( !userCredentialsValid($user, $pass) ){ // return true or false
// well, OK, now something has gone wrong
// did you really pass an empty $user or $pass to the function?
// or did the user send 1MB of data as $user?
// did the username contravene your username rules?
// or did the user /pass combo just not find any matches?
}
The question is how complicated should userCredentialsValid() actually be?
At the moment its job and name is "are the user/pass valid or not?" - its a yes no question, so provide a yes/no response.
If the user commits a blank password, then you should be snagging that fact higher up in your code, if the username contains chars like "? < )" and they are against your rules, then you should be snagging that higher too....
Does userCredentialsValid() need to return a variety of messages? Not in its current state. So leave the responsibility to create a message to the calling code
PHP Code:
if( false === userCredentialsValid($user, $pass) ){ // arguably more readable, nod to immerse...
relocateWithMessage("Those credentials were incorrect, try again.") ;
}
Maybe in your mind you see a function whose job (and therefore name) is:
PHP Code:
function userCredentialsValidateThenSubmitOrGetMessage($user, $pass){
// a pile of security checks
$msgs = array(
// a pile of different text strings for each occasion of an error
);
if(error is found){
return $msg[33];
}else{
return true;
}
}
Bookmarks