My point, pretty much.
tht’s just an basic approach.
you can also use callback methods if the validator class doesn’t provide you the related validation.
I think Codeigniter Validation class might worth giving a try.
Thank you PHPycho
I have Found this perfect for the contact form where it will proof weather an index is empty
if ($_POST['name'] == '') {
echo 'Please make sure you enter a username before submitting the form.';
}
else {
// process results
}
The above script will check weather name is equal to empty then, echo
'Please make sure you enter a name before… else …
Is there another way of checking a different possibility? Let say if the type of form being validated is retrieving information from a database instead of sending information as the contact form, for checking weather a input is NULL meaning it doesn’t match any of the record in the database. so the testing would be weather the index name is NULL instead of empty right?
if ($_POST['name'] == NULL) {
echo 'Please make sure you enter a name before submitting the form.';
}
else {
// process results
}
NULL means when a value is not empty but some other value that doesn’t match another?
Checking whether a value is within permitted values is usually called “bounds checking”.
Its one of the things you need to do that to make sure nobody is trying to send code in through your forms.
filter_var() as mentioned a couple of times above is also a manual page you’ll be glad you stopped, studied, played with and asked questions here about.
If someone enters the name “James Brown” in your form, then the post value will be
$_POST[‘name’] = “James Brown” ;
If “James Brown” does not exist in your database then the mysql query may well return NULL, but your POSTed form will not contain NULL, it’ll contain “James Brown”.
Overall though, your first responsibility is to make sure that you are clear in your mind what “name” is permitted to contain.
Can a name really be 1 character in your world?
How about 2 characters?
Does a name have to have 2 words? each of them at least 2 characters long?
Decide on exactly what consists a name - I mean exactly which characters are permitted and how many, then post back here what you guess, and someone will help you “bounds check” the $_POST[‘name’] before you go quizing your database for that value.
“Stay on the scene!”
I have to check on filter_var() function and so many others, The thing is sometimes is hard for me to get everything together and even understand some terms…
What’s the need of limiting the characters of a name input? it’s that because someone can come and star putting some malicious code and do what ever they want right?
well let say a limit of 20 characters i don’t think a name with it’s last name will get that long if then 25.
Another thing I was doing is studying a php validation class that will check if is a string, number, empty, lenght and among other methods impleted.
here it is it works like a charm.
validationclass.php
<?php
// FormValidator.class.inc
// class to perform form validation
class FormValidator
{
// snip
//
// methods (private)
//
// function to get the value of a variable (field)
function _getValue($field)
{
global ${$field};
return ${$field};
}
// check whether input is empty
function isEmpty($field, $msg)
{
$value = $this->_getValue($field);
if (trim($value) == "")
{
$this->_errorList[] = array("field" => $field,
"value" => $value, "msg" => $msg);
return false;
}
else
{
return true;
}
}
// check whether input is a string
function isString($field, $msg)
{
$value = $this->_getValue($field);
if(!is_string($value))
{
$this->_errorList[] = array("field" => $field,
"value" => $value, "msg" => $msg);
return false;
}
else
{
return true;
}
}
// check whether input is a number
function isNumber($field, $msg)
{
$value = $this->_getValue($field);
if(!is_numeric($value))
{
$this->_errorList[] = array("field" => $field,
"value" => $value, "msg" => $msg);
return false;
}
else
{
return true;
}
}
function isInteger($field, $msg)
{
$value = $this->_getValue($field);
if(!is_integer($value))
{
$this->_errorList[] = array("field" => $field,
"value" => $value, "msg" => $msg);
return false;
}
else
{
return true;
}
}
// check whether input is a float
function isFloat($field, $msg)
{
$value = $this->_getValue($field);
if(!is_float($value))
{
$this->_errorList[] = array("field" => $field,
"value" => $value, "msg" => $msg);
return false;
}
else
{
return true;
}
}
// check whether input is within a valid numeric range
function isWithinRange($field, $msg, $min, $max)
{
$value = $this->_getValue($field);
if(!is_numeric($value) || $value < $min || $value >
$max)
{
$this->_errorList[] = array("field" => $field,
"value" => $value, "msg" => $msg);
return false;
}
else
{
return true;
}
}
// check whether input is alphabetic
function isAlpha($field, $msg)
{
$value = $this->_getValue($field);
$pattern = "/^[a-zA-Z]+$/";
if(preg_match($pattern, $value))
{
return true;
}
else
{
$this->_errorList[] = array("field" => $field,
"value" => $value, "msg" => $msg);
return false;
}
}
// check whether input is a valid email address
function isEmailAddress($field, $msg)
{
$value = $this->_getValue($field);
$pattern =
"/^([a-zA-Z0-9])+([\\.a-zA-Z0-9_-])*@([a-zA-Z0-9_-])+(\\.[a-zA-Z0-9_-]+)+/
";
if(preg_match($pattern, $value))
{
return true;
}
else
{
$this->_errorList[] = array("field" => $field,
"value" => $value, "msg" => $msg);
return false;
}
}
// check whether any errors have occurred in validation
// returns Boolean
function isError()
{
if (sizeof($this->_errorList) > 0)
{
return true;
}
else
{
return false;
}
}
// return the current list of errors
function getErrorList()
{
return $this->_errorList;
}
// reset the error list
function resetErrorList()
{
$this->_errorList = array();
}
// constructor
// reset error list
function FormValidator()
{
$this->resetErrorList();
}
}
?>
Is that possible to assign severals methods to one parameter because right now the form is checking if it is empty. I would like to add the length limit method, and other method to secure the data coming in.
I would like to share the solution to this plus a very nice way to fix repeated header().
here is the form.php file
<div id="tresuno">
<p>Contac us we want to assist you better.....</p>
<div id="tresdos">
<form action="script.php" method="post">
Name<br/><input name="name" type="text" id="name" />
<br/>
Email<br/><input name="email" type="text" id="email"/>
<br/>
Message<br/><textarea name="message" cols="60" rows="8" id="message"></textarea>
<br/>
<input type="submit" value="Send your message" /><br/>
</form>
</div>
</div>
<?php
Below is script.php it will pick up the three indexes name,email, and message then it will instantiate the object and use the method isEmpty. Well that’s the only method used here, but it’s obvious the extensive amount of method in validationclass.php that can be use to enhance the form validation and secure it more. That’s why I was asking if it is possible to use two method for an index here only one is being used. Then if and else statment that will check weather some of the fields are empty then throw the error method else will submit the form. at the else statement you will see the use of the function ob_start();, I have used in there suggested in a thread before, which will serve the send the header() function inside the else statement even when there is html output before the header(). If I take out the ob_start(); function then it will throw and error saying that there is a header already sent in header.php which is included at the if statement of script.php.
I have just heard of ob_start(); and thought about using it here since I need header.php file because I need a background picture inside that file and didn’t want to repeated again. So ob_start(); worked and didn’t result in a conflicting or repetition of headers…
script.php
<?php
include("validationclass.php");
$name = $_POST['name'];
$email = $_POST['email'];
$message = $_POST['message'];
// instantiate object
$fv = new FormValidator();
$fv->isEmpty("name", "Please enter a name");
$fv->isEmpty("email", "Please enter an email");
$fv->isEmpty("message", "Please enter an message");
if ($fv->isError())
{
include("header.php");
$errors = $fv->getErrorList();
echo '<div id="tresu">
<p><b>The operation could not be performed because one or
more error(s) occurred.</b><br/><br/><br/>
Please resubmit the form after making
the following changes:
<div id="tres">';
echo "<ul>";
foreach ($errors as $e)
{
echo "<li>" . $e['msg'];
}
echo "</ul>";
echo'</div>
</div>';
}
else
{
ob_start();
// do something useful with the data
//TO, Subject, Message, Header
mail('mary@hotmail.com','Contact us Message',$message,'From:'.$name.'<'. $email.'>');
header('Location:step3.php');
}
?>
Just wanted to share that…
As I said before How can I secure the data more by using other methods inside the validationclass.php since right now it’s just using the method isEmpty.
Let me go and search about filter_var
It looks like the validation method already has one for checking an email addres
// check whether input is a valid email address
function isEmailAddress($field, $msg)
{
$value = $this->_getValue($field);
$pattern =
"/^([a-zA-Z0-9])+([\\.a-zA-Z0-9_-])*@([a-zA-Z0-9_-])+(\\.[a-zA-Z0-9_-]+)+/
";
if(preg_match($pattern, $value))
{
return true;
}
else
{
$this->_errorList[] = array("field" => $field,
"value" => $value, "msg" => $msg);
return false;
}
}
However, if that method was using filter_var instead, it would look more like this:
// check whether input is a valid email address
function isValidEmailAddress($field, $msg)
{
return $this->isValidType($field, $msg, 'FILTER_VALIDATE_EMAIL');
}
where it makes use of a generic isValidType method to do most of the work for you
// check whether input is of a valid type
function isValidType($field, $msg, $type)
{
$value = $this->_getValue($field);
$validated = filter_var($value, $type);
if ($validated === FALSE) {
$this->_errorList[] = array("field" => $field,
"value" => $value, "msg" => $msg);
return $validated;
}
Above there is three methods, the first one would be use in a email field and second one too. Now i was wondering if the second one which is shorter will have the same effect that the first one does in a input field?
You used the filter_var function in the last method isValidType How would you used that one and in which field?
is that possible to use several method to validate one input value? meanin several methods for on input. and if yes how would that be possible to code or if you have any reference where I can see how is done.
The form I am trying to validate has 5 fields, One is name, zip, state and two string arrays.
1- For the name input I could use the isEmpty,isString and is isAlpha methods, ?
2- for the zip I could use isEmpty, isNumber, isInteger,isFloat and isWithinRange,?
3-For state which is a select i coud use, isEmpty?
4-For the two arrays i could use isEmpty?
i can see in some forms in the web that the email fields uses two methods, For instance i didn’t put anything in the email field and it said please fill in the field email. I also write mary@hotmail. without the “com” and trowed another error saying this is an invalid e-amil format. So right there the e-mail input field used two methods or two distinct validation methods in one input field.
how can that be done talking from an scripting point of view.
Many forms on the web contain 2 sets of validation, the first is Javascript to catch the simplest errors such as not putting anything in a box which is marked as “required”.
This is done for reasons of usability, the user gets immediate feedback, nothing is sent back to the server … depending on the time/skills of the JS programmer then pretty good validation of an email address can be done.
The second is done back at the server, typically to filter out or catch anything invalid.
The main reason for this is that if the user does not have JS turned on, or a bad user decides to circumvent the JS by turning it off, this layer of validation exists to protect your application from attack/corruption.
Be sure you recognise which is which when looking at other people’s forms.
Generally you’d start off by making sure that your application is protected, then work backwards and add the JS level as a “nice to have”.
I am taking it that’s what you mean by “two distinct validation methods”.
He actually means “how can I apply more than one function to a variable”.
Hi Co.ador, buy a book dude 
you won’t regret it 
(or go to the library, I’m not selling anything)
Oh…
Oh well, wont hurt to leave it there.