PHP Input Validation
Any time time a user inputs data to your site the input should be validated to ensure it cannot cause any harm to the system. The obvious characters that cause problems are double and single quotes which are used in injection attacks to trick the server into executing malicious code. However, there are many other special characters and situations that can cause problems. This is especially important with taking input data and storing it a database, or emailing it off, etc.
PHP has built in functions to handle these tasks including preg_replace and substr. I created some functions below that I use for field validation:
They can be called like this:
substr is used to trim the length of text like below. This is especially useful when inputting data into a database fields such as varchar that have limited character lengths.
{
if(strlen($data)>$len)
{
$data = substr($data,0,$len);
}
return $data;
}
For the rest of my filtering, I always use regular expressions to filter out bad characters. I do this because regular expressions allow you to filter characters by specifying what characters you allow – not what characters you want to reject. This is an important distinction because there are so many different character sets and special characters that if you only filter by character replacement, instead of character exclusion, you open yourself up to faulty characters entering the system. If you are currently using str_replace to remove apostrophe’s and quote’s consider upgrading to regular expressions.
This text filtering allows for periods, comma’s and spaces to be used in the text:
Only numbers are returned with this function:
function filterNumeric($data)
{
return preg_replace("/[^0-9]/","",$data);
}When you need to filter a URL, different special characters such as ?, % and / are to be allowed
function filterURL($data)
{
return preg_replace("/[^A-Za-z0-9:_\%\-.\/\?,+]/","",$data);
}This email filtering function doesn’t just filter the characters in email address it also validates it is in username@domain.domaintype format:
function filterEmail($data)
{
list($username, $domain) = explode("@", $data, 2);
$username = preg_replace("/[^a-z0-9._-]+/i", "", $username);
$domain = preg_replace("/[^a-z0-9._-]+/i", "", $domain);
if ( $username == "" || $domain == "" || !strpos($domain,"."))
{
return "";
}
else
{
return $username."@".$domain;
}
}