[nycphp-talk] Best practice for escaping data
Chris Shiflett
shiflett at php.net
Thu Feb 15 20:34:14 EST 2007
Randal Rust wrote:
> Yes, that's what I use it for. Particular fields that I pass
> through it are headline, subheadline, description
All those characters might be in a headline? If so, carry on. If not, it
would be worth finding out (using historical data or something) how you
can restrict your criteria a bit more.
> function validateNumeric($value)
> {
> $value = trim($value);
> $pass = preg_match('/^[0-9]+$/', $value);
> return $pass;
> }
I was going to say you might consider using ctype_digit(), but I guess
your use of "+" is a nice extra check. :-)
If 0 is not a valid value, you could always use ctype_digit() combined
with a simple conditional to ensure the value is > 0.
Chris
--
Chris Shiflett
http://shiflett.org/
More information about the talk
mailing list