Home | 
Forum | 
Wiki | 
Translate | 
Bugtracker | 
WebSVN | USVN
| Information | |
|---|---|
| min. EQDKP-PLUS Version | 0.7.0.0 or higher
|
Contents |
The input class helps you, to get the $_GET, $_POST, $_SERVER, $_COOKIE, $_ENV in a secure way. It uses PHP5 Filter techniques to secure the input given by users.
You should never trust user inputs. Because of that, you'll have to secure these inputs against Injections or XSS. The Input class help you to minimize the time & code to be used for securing it. In 0.7 all $_POST and $_GET calls should be removed and replaced by $in->get calls.
Its pretty simple: Just use this code instead of the $_POST and $_GET calls.
$in->get($key, $default='', $owntype='')
| Option Name | Description | Can be set to |
|---|---|---|
| key | The key, same as in $_GET[key] | string |
| default | The default value. This value will be set, if the call is empty. Use this as security feature. If your input must be integer, set an integer default value, the output is now validated & forced to integer | string/int |
| owntype | Force an own type, do not use the type recognition | FILTER_SANITIZE_NUMBER_FLOAT FILTER_SANITIZE_NUMBER_INT FILTER_SANITIZE_STRING FILTER_SANITIZE_SPECIAL_CHARS |
$in->getArray($key, $type, $max_depth = 10)
| Option Name | Description | Can be set to |
|---|---|---|
| key | The key, same as in $_GET[key] | string |
| type | String-based variable type | string integer float double htmlescape |
| max_depth | Maximum array depth in a recursive array |
To check if a value exists, use the following function
$in->exists($key, $type)
Type is only used for Array inputs. If its a plain input, you do not need to provide this information-
It is possible to get $_POST['members'][4]['name'] via $in->get($key, $default). You simply have to pass as $key "members:4:name". Same is working if you like to fetch an array in an array: $in->getArray('members:2:comment_ids', 'int'); could be such a call.
if($in->get('userid', 0) > 0){ // CODE }
This Code checks id the UserID is larger than null. If no $_POST/$_GET is available, it is set to 0 cause of the fallback provided in the get-call.
Its a bit tricky: empty() or isset() are not working. You should use it at shown in our code sample:
if($in->get('username') != ''){ // CODE }
You simply check if its not equal to an empty string.
|  |