Form validation using functions .

... yes AGAIN! I just need to pick your brain on security issues

[le_gber]

Hi all,

let's say I have a mutli-page form. I use functions to validate each form field individually.

So I have:

---

<?php
require_once(form_check_functions.inc)

foreach ($_REQUEST as $Key => $Value){

($Key === "surname")? $surname = check_surname($_REQUEST['surname']) : '';
($Key === "name")? $name = check_name($_REQUEST['name']) : '';

...

}

?>

in the functions I assign the value of the request to a session if it validates (to carry it across the form pages) and unset the session if it doesn't validate (in case it's ok before and then changed).

If all the form field have a corresponding session my form was correctly field so I move on tho the next step.

---

I was wondered if this was a secure way of doing things and if not, how you would do it.

[RonPK]

I don't see any security holes in that method, but others may.

What strikes me is that you seem to have a bunch of functions that will be used only once, such as check_name. That creates unnecessary extra server load. Why not do the validation and the assignment to session variables in the foreach-loop?

[le_gber]

Hi RonPK,

I use to have one very big function with all the checks in but I split it up on the advice of someone knowing PHP better than me. That way I can use them for other forms on ths site as well even if they don't include all the fields.

[justgowithit]

It was always suggested to me to end includes in '.inc.php' for that little added security.

If compromised a file ending in ‘.inc’ will show all – a file ending in ‘.inc.php’ will not.

[Sekka]

That's a very good point.

I keep my entire "system" in a .htaccess protected folder so it can't be comprised as easily. It's included from there into other PHP files.

[le_gber]

re the filename ending with a .php, it's what I do as well, (never used .inc) it was just as an example :) - thanks anyway people

[eeek]

I keep my entire "system" in a .htaccess protected folder

A better way is to keep your includes completely outside of the document tree. That way a mistake in your .htaccess won't expose the files.

[Sekka]

True, but then I'd have to change the root access for PHP, which isn't the best of ideas.