validation - Is it possible to force your PHP input variables to be strong typed -
when started off php, happy how php loosely typed , how easy learn. grew it, realized being loosely typed complicated scripts rather simplifying them. , looking ways strong type php variables, input variables ($_post
, $_get
, $_cookie
, $_request
, $_server
vars).
also, validation , sanitizing hidden away in process can "forget" sql injection , many of other error prone validation processes. have rough sketch of how want be.
first declare variable. preferably in oop
$varclass->post->variable_name->type('str', 'sql', 'email'); // or array $_my_post['variable_name'] = array('str', 'sql', 'emiail');
now possibly drop undeclared variable predefined php globals , use variable type validate , sanitize them directly in global arrays.
set values of unvalidated variables emaill bool false , un-submitted null , use them during data validation. however, before went off , re-invented wheel hoping:
some 1 might direct me library helps solve issues?
if there reasons why shouldn't pursue on wild fantasy? better , more clear ways of achieving this?
, other general thoughts may have idea?
http://sourceforge.net/p/php7framework/wiki/input/
wraps superglobals per default, instantiate local objects $postfilter = new input($_post)
. it's supposed used manually this:
$_post->email->sql["variable_name"] $_post->array->int["order_list"]
and complains if sees $_post["raw"] access.
but can pre-define filter lists. centrally in class-definition. supposed add-on old applications, don't want manually go through code , rewrite strings enforce data formats or types:
var $__rules = array( "variable_name" => "email,sql", "order_id" => "int,range:0:500", "order_list" => "array,int", );
but avoid ->sql escaping prematurely. if available pdo , parameterized sql should used. of course central escaping feature anyway better cautiosness.
also can define custom filters. picks global functions example.
Comments
Post a Comment