Detecting if boolean

[ocon]

For security reasons, I'm trying to validate some user input variables.

I have my own form that gives consistent returns, but I also want to be able to take other PHP "valid" responses to some yes or no questions for other webmasters to be able to easily use my script.

On my form I have the following code:

<label for="pregnant"><input type="checkbox" id="pregnant" name="pregnant" value="true" />I am pregnant.</label>

Using the code above, if the box is checked it returns: ?pregnant=true
Else, it returns nothing: ?

But in order to validate this yes or now answer, I'm using the following sloppy code:

$pregnant = strtolower($_GET["pregnant"]);
if($pregnant != "true" && $pregnant != "1" && $pregnant != "false" && $pregnant != "0" && $pregnant != "") die("Bad pregnant value.");

Is there a better way to check if a value is a variable?

I've been playing around with settype and is_bool to no luck.

[Matthew1980]

Hi there ocon,

Don't forget that when submitting detail via a submitted form, irrespective of whether it is $_POST or $_GET, the default 'type' being sent through from the form to the server is string.

First thing as you need to do with this data is type cast it so that you get the results that you expect.

Have a read of this [php.net], then you will see what I mean.

Then hopefully you can refine your if clause, and try to parenthesis your evaluations so as not to confuse php too much. Think of it as an algebra equation, then you will be able to see what to do then...

Cheers,
MRb

[rocknbil]

You're making it more complicated than it has to be. :-) This is the key to your answer:

Else, it returns nothing: ?

Exactly. This is the result of browser function: they will only submit checkbox values if they are checked.

This makes security in respect to this field irrelevant. All you're doing is checking if it's set, you're not actually inserting the form input in your database, giving you one less field to validate. (Extension of Selena Sol's "Use only what you want and throw everything else away.")
So all you need to do is

// Or $_POST as mentioned, this would be better as it
// doesn't result in "ugly query strings" in the address bar

$preggers = (isset($_GET["pregnant"]))?'Yes':'No';

Or, if you're (wisely) using a boolean or tinyint field for this purpose,

$preggers = (isset($_GET["pregnant"]))?1:0;

insert into table (pregnant) values($preggers);

Let's add to that last one: if you use a numeric representation for this field, declare this global array somewhere. You can use it for any yes/no display.

$YesNos = Array('No','Yes');

$query = "select pregnant from table";
$result = mysql_query($query) or die("cannot query table");
while ($row = mysql_fetch_array($result)) {
echo "<p>" . $YesNos[$row['pregnant']] . "</p>";
}