Skip to Main Content
MySQL Cookbook
book

MySQL Cookbook

by Paul DuBois
October 2002
Intermediate to advanced content levelIntermediate to advanced
1024 pages
27h 26m
English
O'Reilly Media, Inc.
Content preview from MySQL Cookbook

Validating Web Input

Problem

After extracting the parameters supplied to a script, it’s a good idea to check them to be sure they’re valid.

Solution

Web input processing is one form of data import, so after you’ve extracted the input parameters, you can validate them using the techniques discussed in Chapter 10.

Discussion

One phase of form processing is to extract the input that comes back when the user submits the form. It’s also possible to receive input in the form of parameters at the end of a URL. But no matter the input source, if you’re going to store it in your database, it’s a good idea to check it to be sure it’s valid.

When a client sends input to you over the Web, you don’t really know what they’re sending. If you present a form for users to fill out, most of the time they’ll probably be nice and enter the kinds of values you expect. But a malicious user can save the form to a file, modify the file to allow form options you don’t intend, reload the file into a browser window, and submit the modified form. Your form-processing script won’t know the difference. If you write it only to process the kinds of values that well-intentioned users will submit, the script may misbehave or crash when presented with unexpected input—or perhaps even do bad things to your database. (Recipe 18.8 discusses what kinds of bad things can happen.) For this reason, it’s prudent to perform some validity checking on web input before using it to construct database queries.

Preliminary checking ...

Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.
Start your free trial

You might also like

MySQL Reference Manual

MySQL Reference Manual

Michael Widenius, David Axmark, Kaj Arno
High Performance MySQL

High Performance MySQL

Jeremy D. Zawodny, Derek J. Balling
MySQL Stored Procedure Programming

MySQL Stored Procedure Programming

Guy Harrison, Steven Feuerstein

Publisher Resources

ISBN: 0596001452Catalog PageErrata