MySQL Cookbook

Validating Web Input

Problem

After extracting the parameters supplied to a script, it’s a good idea to check them to be sure they’re valid.

Solution

Web input processing is one form of data import, so after you’ve extracted the input parameters, you can validate them using the techniques discussed in Chapter 10.

Discussion

One phase of form processing is to extract the input that comes back when the user submits the form. It’s also possible to receive input in the form of parameters at the end of a URL. But no matter the input source, if you’re going to store it in your database, it’s a good idea to check it to be sure it’s valid.

When a client sends input to you over the Web, you don’t really know what they’re sending. If you present a form for users to fill out, most of the time they’ll probably be nice and enter the kinds of values you expect. But a malicious user can save the form to a file, modify the file to allow form options you don’t intend, reload the file into a browser window, and submit the modified form. Your form-processing script won’t know the difference. If you write it only to process the kinds of values that well-intentioned users will submit, the script may misbehave or crash when presented with unexpected input—or perhaps even do bad things to your database. (Recipe 18.8 discusses what kinds of bad things can happen.) For this reason, it’s prudent to perform some validity checking on web input before using it to construct database queries.

Preliminary checking ...