MySQL Cookbook, 2nd Edition

Validating Web Input

Problem

After extracting the parameters supplied to a script, you want to check them to be sure they’re valid.

Solution

Web input processing is one form of data import, so after you’ve extracted the input parameters, you can validate them using the techniques discussed in Chapter 10.

Discussion

One phase of web form processing is to extract the input that comes back when the user submits the form. It’s also possible to receive input in the form of parameters at the end of a URL. Either way, if you’re going to store the input in your database, it’s a good idea to check it to be sure that it’s valid.

When clients send input to you over the Web, you don’t really know what they’re sending. If you present a form for users to fill out, most of the time they’ll probably be nice and enter the kinds of values you expect. But a malicious user can save the form to a file, modify the file to allow form options you don’t intend, reload the file into a browser window, and submit the modified form. Your form-processing script won’t know the difference. If you write it only to process the kinds of values that well-intentioned users will submit, the script may misbehave or crash when presented with unexpected input—or perhaps even do bad things to your database. (Storing Web Input in a Database discusses what kinds of bad things can happen.) For this reason, it’s prudent to perform some validity checking on web input before using it to construct SQL statements.

Preliminary checking ...