PHP form validation

[thesk8rjesus]

i am currently in the process of creating a form for our sixth forms website. I have been able to validate input boxes and drop down boxes which just consist of numbers between a range. but i am having a problem with validating a drop down which gets it options from a different php page i have:

 

<?php

include("courselist.php");

?>

 

i have my validation all set up ready to go, heres an example of my name input box:

 

 

if someone could please help me it would be amazing!!

 

THANK YOU IN ADVANCED

[powdarrmonkey]

Do you mean validating or just parsing? More details would help, eg what is the contents of courselist.php?

[thesk8rjesus]

i mean validating i want it to appear with an error if the option which is selected is 'Select Course' here is courselist.php:

print 'Select Course

Art and Design (BTEC)

Art and Design (NVQ)

Art (Fine)

Art (Textiles)

Beauty Therapy

Biology

Biology (Human)

Body Treatments

Business and Administration

Business Studies

Chemistry

Child Care and Education

Community Sports Leadership

Construction and the Built Environment

Construction (Trowel Occupations)

Critical Thinking

Customer Service

Design Technology (Graphic Product)

Design Technology (Resistant Materials)

English

English for Speakers of Other Languages (ESOL)

European Computer Driving Licence (ECDL)

Exercise and Nutrition

Film Studies

French

Geography

German

Government and Politics

Hair and Beauty Studies

 

Hairdressing

Health and Nutrition

Health and Social Care

Health and Social Care (Double Award)

History

ICT

Law

Leisure Studies

Literacy

Mathematics

Media Studies

Music Performance

Music Technology

Nail Technology

Numeracy

Performing Arts (Acting)

Performing Arts (Dance)

Personal Finance

Photography

Professional Chef

Psychology

Public Services

RE

Retail

Science

Science (Forensic Science)

Society Health and Development

Sociology

Spanish

Sport and Exercise Science

Text Processing (Business Professional)

Travel and Tourism

';

?>

[powdarrmonkey]

Ok... and what are you doing to validate it, what doesn't work, and what error gets returned as a result?

[DrPerceptron]

Do you not need a before and after your options?

 

I remember validating a drop down list a long time ago and just used the name of the select tag and checked it didn't match the string you want to validate...

[craigy2302]

You could do this without any validation... Just by adding "disabled selected" to your option.

 

For example

print 'Select Course

 

This would prevent users from even 're-selecting' the Select Course, its not totally fool proof but a start.

[powdarrmonkey]

You could do this without any validation... Just by adding "disabled selected" to your option.

 

For example

print 'Select Course

 

This would prevent users from even 're-selecting' the Select Course, its not totally fool proof but a start.

 

You should always sanitize input until you're blue in the face, because it's trivial to inject nasty stuff if you don't. You can't rely on the user agent to enforce your display criteria.

 

 

@DrPerceptron:

which gets it options from a different php page i have:

 

<?php

include("courselist.php");

?>

[DrPerceptron]

Didn't read the first sentence of that post, my bad

[craigy2302]

If you add a name to the select, for example,

 

Then where the form is processed, put something like

 

if ($_SEVER['REQUEST_METHOD'] == "POST"){
  $options = htmlentities($_POST['options']);

  if ($options == "Select Course"){
     // Your error message - or - kill the script
     die("You did not select a Course, please go back and try again");
  }
}

 

That's a very simple validation and sanitise method.

 

@powdarrmonkey: It's just as bad with "selected disabled" removed

[powdarrmonkey]

if ($_SEVER['REQUEST_METHOD'] == "POST"){
  $options = htmlentities($_POST['options']);

 

$_SERVER['....

 

@powdarrmonkey: It's just as bad with "selected disabled" removed

 

Of course, but I assumed that if you're going to present all options to a user, you're hopefully expecting to deal with all of them. It's not safe, however, to assume that because you haven't presented it, they haven't sent it to you.

 

Checking that you have a valid option is validation, sanitation is checking that what you've got isn't dangerous. Example: if you used that response blind in a mysql SELECT statement, the first port of call for any self-respecting attacker is to inject "DROP DATABASE;", "DROP `users`", or similar into that field, which you then pass on directly to your database. Danger, Will Robinson.

 

So high-level basic sanitation might include:

1. cut the field to a sensible length, to prevent buffer-overflows

2. clean it of scary things, like html entities and sql statements

 

Then you validate it ('was this an option in the list, or has the user made it up?'), once you're sure it's safe to start handling it in the memory space of your application.

[lightinthedark]

If you want to check that the value given is one of the ones you displayed (rather than just not "Select Course"), I'd suggest that you need an array of your options available at the time of validation. So, I'd change courselist.php from

print 'Select Course

Art and Design (BTEC)
Art and Design (NVQ)
Art (Fine)
Art (Textiles)
...

 

to something more like

$courseList = array( 'Select Course', 'Art and Design (BTEC)', 'Art and Design (NVQ)', 'and so on and so on');

function renderCourseList($list) {
 foreach($list as $opt) {
   $opt = htmlspecialchars($opt);
   echo "$opt\n";
 }
}
?>

 

Then in your original file make it:

include('courselist.php');
renderCourseList($courseList);
?>

(the include now means that $courseList is defined here, so we send that list off to be rendered)

 

And in your validation page

include('courselist.php');
if( ($tmp = array_search($_POST['choice1_course'], $courseList)) === false ) {
 // Your error message - or - kill the script
 die("Invalid Course given, please go back and try again");
}
else {
 $choice1 = $courseList[$tmp]; // pick a variable name that suites you
}

if( $choice1 == 'Select Course' ) {
 // Your error message - or - kill the script
 die("You did not select a Course, please go back and try again");
}

 

This way you know that the value of $choice1 is something from your array, so you know that it won't have scary things (other than any you put in there yourself to make your life interesting) in it.

 

Hello

:-Dave

Edited January 21, 2009 by lightinthedark
[PHP] is prettier than [code]. Also forgot to check for 'Select Course'.