How to filter and validate user input in Zend Framework

Question

on my website I have a comment section. I want to filter and validate the input before I store it in my database. If there are any invalid chars in the input the user gets the notice that his input is invalid.

My question, which chars are not allowed? e.g. I want to avoid sql injections

Tags are not allowed. How do I check that?

Josh · Accepted Answer · 2011-11-13 17:11:16Z

2

If you are using Zend_Db and parameterised queries (i.e.: $adapter->insert($tableName, array('param' => 'value'))) then it will automagically escape everything for you.

If however you want to further validate the user input, have a look at Zend_Validate and Zend_Filter

Also, if by "tags" you mean HTML tags, I wouldn't do anything to those on input but do make sure you properly escape / strip them on output (have a look at htmlspecialchars())

If you want to display an error message if the input contains HTML tags, and assuming $comment is the comment body, you could try:

if(strip_tags($comment) !== $comment) {
    // It seems it contained some html tags
}

edited Nov 13, 2011 at 17:11

Josh

11.1k11 gold badges67 silver badges112 bronze badges

answered Aug 29, 2010 at 7:39

Andrei Serdeliuc ॐ

5,8785 gold badges41 silver badges66 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

DarkLeafyGreen Over a year ago

thanks, I escape things on output already. but why should I allow the user to input html tags. I want an error message to be displayed that the input is invalid

Andrei Serdeliuc ॐ Over a year ago

altered the answer with an example on how to show an error message if it contains html tags. I'm not sure what the context of the comment is, but it's generally harmless to allow but escape html tags. For example, if you were running a website about web development, maybe the commenter will include HTML tags as an example.

Collectives™ on Stack Overflow

How to filter and validate user input in Zend Framework

1 Answer 1

2 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

2 Comments

Your Answer

Sign up or log in

Post as a guest

Related