Valadate Forms Input

Client Joined: Jul 19, 2005 Posts: 68

Hi I just found this example of a simple form valadation script, can anyone advise m on its security. if its ok ill use it in a RN nuke module.
I found it here ;
http://www.dreamincode.net/forums/showtopic46323.htm

Code:




<?php


if(isset($_POST['formdata'])) {


$information = $_POST['formdata'];


$validate1 = eregi('[^a-z0-9 ]', $information);


$validate1 = (int)$validate1;


$validate2 = eregi('naughty|word', $information);


$validate2 = (int)$validate2;


$validate3 = eregi('[0-9] [a-z]{4,}', $information);


$validate3 = (int)$validate3;


$validate4 = eregi('^(STAFF_)', $information);


$validate4 = (int)$validate4;


$validate5 = strlen($information);


if ($validate1 == 0 && $validate2 == 0 && $validate3 == 1 && $validate4 == 0 && $validate5 > 2 && $validate5 < 25) {


echo "Success!  \"<i>$information</i>\" is a valid string";


// Coding goes here.... inserting to a database?  Setting cookies?  Who knows.  But it passed the gauntlet


} else { 


echo "Sorry, \"<i>$information</i>\" failed.  Here's why: <ul>";


   if ($validate1 == 1) {


echo "<li>Your string contains invalid characters.  It can only contain letters, numbers, and spaces.</li>";


} if ($validate2 == 1) {


echo "<li>Egad!  Don't talk like that! (Hotwords: 'naughty' and 'word')</li>";


} if ($validate3 == 0) {


echo "<li>That doesn't look like a valid address to me! (Must be a number, follwed by a space, then at least four letters)</li>";


} if ($validate4 == 1) {


echo "<li>Sorry, but all accounts starting with <b>STAFF_</b> have been reserved.</li>";


} if ($validate5 < 3) {


echo "<li>\"<i>$information\"</i> is too short (only $validate5 characters)!  It needs to be at least 3.</li>";


} if ($validate5 > 24) {


echo "<li>\"<i>$information</i>\" is too long (a whole $validate5 characters)!  It can't be more than 24.</li>";


}


echo "</ul>";  }


}


?>


<br />


<form action='validator.php' method='post'>


<input type='text' name='formdata' />


<input type='submit' value='Test that string!' />


</form>

[/url]

Posted: Tue Apr 28, 2009 11:35 pm

Sounds like it's a signup form for me. Yes it's good for me. Doesn't allow anything else than [0-9][A-z].

Paranoia rule #1 Thou will not let malicious usernames in your SQL

Posted: Wed Apr 29, 2009 7:19 am

You should not need to do a int on all those expressions. Eregi will tell you whether it matches directly.

Posted: Wed Apr 29, 2009 11:43 am

Nuke has its own signup process which i use, but id like to collect other data that data is as said only short inputs a/z 0/9.

Thanks for the input.