Just a small question?

[Danny620]

should i use regular expression to vailadate user input or is there some other way which is more secure to use.

[Maq]

EDIT:  Input for what exactly?

[.josh]

depends on what the input is. 

[Danny620]

like usernames,passwords,emails things that i would store in the datbase

[Maq]

like usernames,passwords,emails things that i would store in the datbase

 

You can use regex to verify the format, characters, length etc...  But you would actually want to sanitize input with methods such as mysql_real_escape_string.

[.josh]

right...but the point is, different things would have different formats, right?  For instance, you may only want a username to be just letters, no spaces, etc.. or only 5-15 chars long, etc... passwords you may want them to be at least x length long and  have at least x amount of numbers or capital letters in them or whatever.  You may want to only accept certain emails.  You have to figure out what you want to accept for each input field, and then go from there.  After you figure out what you do and do not want to accept for each one, you can figure out the best way to validate it.  The ideal solution may be regex for one, but not another, etc...

 

like usernames,passwords,emails things that i would store in the datbase

 

You can use regex to verify the format, characters, length etc...  But you would actually want to sanitize input with methods such as mysql_real_escape_string.

 

mysql_real_escape_string may not be necessary, depending on what kind of validation is figured out.  For instance, if OP decides he only wants to accept letters for the username, I can do this, and there would be no need to use mysql_real_escape_string:

 

if (preg_match('~^[a-z]+$~i',$_POST['username'])) {
  // valid
} else {
  // invalid
}

 

If it's valid, there'd be no reason to escape it, as it would only be letters.

[Danny620]

what about this custom function i made

 

	//Function val validates form submissions by;
//Striping html tags from from;
//Must be greater than three letters long;

function val($field = false){
			global $dbc;
			$errors = false;

		if(strlen($field) > 3 && strlen($field) < 15){

		strip_tags($field);
		$username = $field;
		$username = mysqli_real_escape_string($dbc,$username);
	    echo $username;

		} else { 

		$errors = "The field must be at least 3 characters long & no more than 15 characters!";

	  }

		if($errors){

	return $errors; }

		}

	//END of val function;
?>

[JonnoTheDev]

what about this custom function i made

Its not really a true function as it has no definable parameters. It checks a string is between 5 & 15 characters in length. Where would you re-use the function in your script? If the min and max characters were parameters then the function becomes more useful as you could use in a variety of forms you may have on the same site.

 

Simple example

function checkStrMinMax($string, $min, $max) {
  $len = strlen(trim($string));
  if($len < $min) {
     return false;
  }
  if($len > $max) {
     return false;
  }
   return true;
}
if(!checkStrMinMax($string, 3, 15)) {
  print "username must be 3 - 15 characters";
}

 

Also don't use global variables in functions. Add as parameters