来源:http://trac.seagullproject.org/wiki/Howto/InputValidation

Input validation

获得并净化 request数据

    $input->from            = $req->get('frmFrom') ? $req->get('frmFrom') : 0;
    $input->catID           = $req->get('frmCatID');
    $input->deleteArray     = $req->get('frmDelete');
    $input->queryRange      = $req->get('frmQueryRange');
    $input->bodyValue       = $req->get('frmBodyName', $allowTags = true);
 
    //  request values for upload
    $input->assetFileArray        = $req->get('assetFile');
    $input->assetFileName         = $input->assetFileArray['name'];
    $input->assetFileType         = $input->assetFileArray['type'];
    $input->assetFileTmpName      = $input->assetFileArray['tmp_name'];
    $input->assetFileSize         = $input->assetFileArray['size'];
 
    //  determine user type
    $input->isAdmin = (Session::getAuthLevel() == SGL_ADMIN);
 
    //  request values for save upload
    $input->document = (object)$req->get('document');

发生了下列变量净化:

  • 删除空格
  • 赋给默认值
  • 转换成更复杂的数据类型 如,对象,数组
  • 自动去除HTML,除非设置了$allowTags = true
  • 如果允许HTML,则剥离掉javascript以减少XSS攻击
  • magic quotes dealt with regardless of installation default

设置本地化错误信息

在验证输入时,你也可以设置翻译过的错误信息。在模块中使用英语,在模板中调用translate()函数:

    require_once 'Validate.php';
    $aErrors = array();
    if ($input->submit) {
        $v = & new Validate();
        if (empty($input->contact->first_name)) {
            $aErrors['first_name'] = 'You must enter your first name';
        }
        if (empty($input->contact->last_name)) {
            $aErrors['last_name'] = 'You must enter your last name';
        }
        if (empty($input->contact->email)) {
            $aErrors['email'] = 'You must enter your email';
        } else {
            if (!$v->email($input->contact->email)) {
                $aErrors['email'] = 'Your email is not correctly formatted';
            }
        }
    //  if errors have occured
    if (is_array($aErrors) && count($aErrors)) {
        Output::msgSet('Please fill in the indicated fields');
        $input->error = $aErrors;
        $this->validated = false;
    }
    return $input;

在模块中:

<span class="error" flexy:if="error[username]">{translate(error[username])}</span>
<input type="text" name="user[username]" id="user[username]" value="{user.username}" />

Determine which button was pressed

你有一个列表来检查各项,表单底部有两个按钮:

{translate(#With selected bookmark(s)#)}: 
<input type="submit" name="delete" value="{translate(#delete#)}" 
        onclick="return confirmSubmit('bookmark', 'bookmarks')" /> 
<input type="submit" name="resetCounter" value="{translate(#reset Counter#)}" 
       onclick="return confirmCustom('{translate(#You must select a bookmark to reset#)}', '{translate(#Are you sure you want to reset this bookmark(s)?#)}', 'bookmarks')"/>

In the $myManager→validate($req, &$input) is this code:

 
    $input->action = $req->get('action') ? $req->get('action') : 'list';
 
    // determine action based on which button was pressed
    if ($req->get('delete')) { $input->action = 'delete'; }
    if ($req->get('resetCounter')) { $input->action = 'resetCounter'; }
?>

注意:如果你使用图像按钮,如<input type=“image”…>,不要忘了给一个值,否则: * 如果图像被破坏,浏览器将会显示一个事有值的普通按钮 * if 如果没有赋值,上面所讲的就不能工作…

 
howto/inputvalidation.txt · 最后更改: 2010/05/30 00:21 (外部编辑)
 
Except where otherwise noted, content on this wiki is licensed under the following license:GNU Free Documentation License 1.2