NYCPHP Meetup

NYPHP.org

[nycphp-talk] Best practice for escaping data

Chris Shiflett shiflett at php.net
Thu Feb 15 20:34:14 EST 2007


Randal Rust wrote:
> Yes, that's what I use it for. Particular fields that I pass
> through it are headline, subheadline, description

All those characters might be in a headline? If so, carry on. If not, it
would be worth finding out (using historical data or something) how you
can restrict your criteria a bit more.

> function validateNumeric($value)
> {
>     $value = trim($value);
>     $pass = preg_match('/^[0-9]+$/', $value);
>     return $pass;
> }

I was going to say you might consider using ctype_digit(), but I guess
your use of "+" is a nice extra check. :-)

If 0 is not a valid value, you could always use ctype_digit() combined
with a simple conditional to ensure the value is > 0.

Chris

-- 
Chris Shiflett
http://shiflett.org/



More information about the talk mailing list