Validating input...

[The Plankmeister]

Hi...

What's the best method of validating input characters? I would like to
prevent users submitting exotic characters (such as those acquired on
Windows Systems by pressing ALT+[keypad number of your choice]) and thought
a way of doing this would be to compare the submitted strings with the array
keys returned by get_html_transl ation_table(HTM L_ENTITIES), but padding this
array out with all the remaining normal keyboard characters.

But... am I reinventing the wheel? Surely there must be an existing function
along the lines of: valid_charset($ str_blah, "iso-8859-01") or somesutch?!

Here's hoping...

Plankmeister.

[Agelmar]

Re: Validating input...

I don't know what you mean by validating input characters, really. I mean,
whatever they type is going to get translated into *something* in your
charset. If you want to restrict the user to using a specified charset,
however, this can be done client-side as it's a part of the HTML 4.0
standard. See http://www.w3.org/TR/REC-html40/interact/forms.html
(specifically accept-charset). One thing I would caution you on, however, is
to watch your definition of valid. For example, if you ask for an address
and someone gives:

Königin-Elisabeth Straße 47a in 14059 Berlin (the address of my favorite
Hotel), are you going to consider that invalid input?

The Plankmeister wrote:[color=blue]
> Hi...
>
> What's the best method of validating input characters? I would like to
> prevent users submitting exotic characters (such as those acquired on
> Windows Systems by pressing ALT+[keypad number of your choice]) and
> thought a way of doing this would be to compare the submitted strings
> with the array keys returned by
> get_html_transl ation_table(HTM L_ENTITIES), but padding this array out
> with all the remaining normal keyboard characters.
>
> But... am I reinventing the wheel? Surely there must be an existing
> function along the lines of: valid_charset($ str_blah, "iso-8859-01")
> or somesutch?!
>
> Here's hoping...
>
> Plankmeister.[/color]

[The Plankmeister]

Re: Validating input...

"Agelmar" <ifetteNOSPAM@c omcast.net> wrote in message
news:bti1uf$791 07$1@ID-30799.news.uni-berlin.de...[color=blue]
> I don't know what you mean by validating input characters, really. I mean,[/color]

I didn't explain it very well... Apologies... What I mean by 'validating
input characters' is having a function {for instance
valid_charset($ str_to_check, "iso-8859-01") } which returns true if all the
characters in the passed string are characters that appear in the indicated
character set., but false if it finds characters that are not valid for the
specified character set. This way, bizarre characters (such as that produced
by ALT + keypad 985) would be rejected...
[color=blue]
> whatever they type is going to get translated into *something* in your
> charset. If you want to restrict the user to using a specified charset,
> however, this can be done client-side as it's a part of the HTML 4.0[/color]

Doing anything client-side is unreliable as a crafty user can make his own
form and submit it, thereby circumventing the validation. I do %100 of my
validation on the server side, though in most cases I also do client-side
validation so that your average user doesn't have to wait for the submission
to be processed before seeing where they went wrong.
[color=blue]
> standard. See http://www.w3.org/TR/REC-html40/interact/forms.html
> (specifically accept-charset). One thing I would caution you on, however,[/color]
is[color=blue]
> to watch your definition of valid. For example, if you ask for an address
> and someone gives:
>
> Königin-Elisabeth Straße 47a in 14059 Berlin (the address of my favorite
> Hotel), are you going to consider that invalid input?
>[/color]

Yeah... that would be valid because all those characters appear in
get_html_transl ation_table(HTM L_ENTITIES).


Plankmeister


[color=blue]
> The Plankmeister wrote:[color=green]
> > Hi...
> >
> > What's the best method of validating input characters? I would like to
> > prevent users submitting exotic characters (such as those acquired on
> > Windows Systems by pressing ALT+[keypad number of your choice]) and
> > thought a way of doing this would be to compare the submitted strings
> > with the array keys returned by
> > get_html_transl ation_table(HTM L_ENTITIES), but padding this array out
> > with all the remaining normal keyboard characters.
> >
> > But... am I reinventing the wheel? Surely there must be an existing
> > function along the lines of: valid_charset($ str_blah, "iso-8859-01")
> > or somesutch?!
> >
> > Here's hoping...
> >
> > Plankmeister.[/color]
>
>[/color]

[Andy Hassall]

Re: Validating input...

On Wed, 7 Jan 2004 23:57:47 +0100, "The Plankmeister"
<plankmeister_N OSPAM_@hotmail. com> wrote:
[color=blue]
>"Agelmar" <ifetteNOSPAM@c omcast.net> wrote in message
>news:bti1uf$79 107$1@ID-30799.news.uni-berlin.de...[color=green]
>> I don't know what you mean by validating input characters, really. I mean,[/color]
>
>I didn't explain it very well... Apologies... What I mean by 'validating
>input characters' is having a function {for instance
>valid_charset( $str_to_check, "iso-8859-01") } which returns true if all the
>characters in the passed string are characters that appear in the indicated
>character set., but false if it finds characters that are not valid for the
>specified character set. This way, bizarre characters (such as that produced
>by ALT + keypad 985) would be rejected...[/color]

Alt+985 gives me a + sign on Windows, so not sure what you mean here.

All 255 byte values are valid ISO-8859-1, although there are two ranges of
control characters. If you try and copy and paste a Unicode character in, e.g.
Chinese characters, if you've got the right character set headers then IE and
Mozilla (at least) send the HTML entity and NOT the raw Unicode character. So
you end up with something like 顓, which is all valid ISO-8859-1.
[color=blue][color=green]
>> whatever they type is going to get translated into *something* in your
>> charset. If you want to restrict the user to using a specified charset,
>> however, this can be done client-side as it's a part of the HTML 4.0[/color]
>
>Doing anything client-side is unreliable as a crafty user can make his own
>form and submit it, thereby circumventing the validation. I do %100 of my
>validation on the server side, though in most cases I also do client-side
>validation so that your average user doesn't have to wait for the submission
>to be processed before seeing where they went wrong.[/color]

I suppose you'd want to avoid 0-31 and 127-159 in ISO-8859-1/15 to avoid the
control characters (is this what you want?), but all 255 values _are_ valid.

--
Andy Hassall (andy@andyh.co. uk) icq(5747695) (http://www.andyh.co.uk)
Space: disk usage analysis tool (http://www.andyhsoftware.co.uk/space)

[Chung Leong]

Re: Validating input...

Use regular expression:

$s = "This is a test";

if(preg_match("/^[\\x20-\\x7F]*$/", $s)) {
echo "Hey!";
}

If the user type in characters that fall outside of iso-8859-01 (and the
page is set to use that encoding), I think the browser would replace them
with HTML entities (e.g. ϙ). If you don't want these then you'd have to
check for them explicitly.

Uzytkownik "The Plankmeister" <plankmeister_N OSPAM_@hotmail. com> napisal w
wiadomosci news:3ffc8edf$0 $27378$edfadb0f @dread16.news.t ele.dk...[color=blue]
> "Agelmar" <ifetteNOSPAM@c omcast.net> wrote in message
> news:bti1uf$791 07$1@ID-30799.news.uni-berlin.de...[color=green]
> > I don't know what you mean by validating input characters, really. I[/color][/color]
mean,[color=blue]
>
> I didn't explain it very well... Apologies... What I mean by 'validating
> input characters' is having a function {for instance
> valid_charset($ str_to_check, "iso-8859-01") } which returns true if all[/color]
the[color=blue]
> characters in the passed string are characters that appear in the[/color]
indicated[color=blue]
> character set., but false if it finds characters that are not valid for[/color]
the[color=blue]
> specified character set. This way, bizarre characters (such as that[/color]
produced[color=blue]
> by ALT + keypad 985) would be rejected...
>[color=green]
> > whatever they type is going to get translated into *something* in your
> > charset. If you want to restrict the user to using a specified charset,
> > however, this can be done client-side as it's a part of the HTML 4.0[/color]
>
> Doing anything client-side is unreliable as a crafty user can make his own
> form and submit it, thereby circumventing the validation. I do %100 of my
> validation on the server side, though in most cases I also do client-side
> validation so that your average user doesn't have to wait for the[/color]
submission[color=blue]
> to be processed before seeing where they went wrong.
>[color=green]
> > standard. See http://www.w3.org/TR/REC-html40/interact/forms.html
> > (specifically accept-charset). One thing I would caution you on,[/color][/color]
however,[color=blue]
> is[color=green]
> > to watch your definition of valid. For example, if you ask for an[/color][/color]
address[color=blue][color=green]
> > and someone gives:
> >
> > Königin-Elisabeth Straße 47a in 14059 Berlin (the address of my favorite
> > Hotel), are you going to consider that invalid input?
> >[/color]
>
> Yeah... that would be valid because all those characters appear in
> get_html_transl ation_table(HTM L_ENTITIES).
>
>
> Plankmeister
>
>
>[color=green]
> > The Plankmeister wrote:[color=darkred]
> > > Hi...
> > >
> > > What's the best method of validating input characters? I would like to
> > > prevent users submitting exotic characters (such as those acquired on
> > > Windows Systems by pressing ALT+[keypad number of your choice]) and
> > > thought a way of doing this would be to compare the submitted strings
> > > with the array keys returned by
> > > get_html_transl ation_table(HTM L_ENTITIES), but padding this array out
> > > with all the remaining normal keyboard characters.
> > >
> > > But... am I reinventing the wheel? Surely there must be an existing
> > > function along the lines of: valid_charset($ str_blah, "iso-8859-01")
> > > or somesutch?!
> > >
> > > Here's hoping...
> > >
> > > Plankmeister.[/color]
> >
> >[/color]
>
>[/color]

[The Plankmeister]

Re: Validating input...


"The Plankmeister" <plankmeister_N OSPAM_@hotmail. com> wrote in message
news:3ffc78d2$0 $27432$edfadb0f @dread16.news.t ele.dk...[color=blue]
> Hi...
>
> What's the best method of validating input characters? I would like to
> prevent users submitting exotic characters (such as those acquired on
> Windows Systems by pressing ALT+[keypad number of your choice]) and[/color]
thought[color=blue]
> a way of doing this would be to compare the submitted strings with the[/color]
array[color=blue]
> keys returned by get_html_transl ation_table(HTM L_ENTITIES), but padding[/color]
this[color=blue]
> array out with all the remaining normal keyboard characters.
>
> But... am I reinventing the wheel? Surely there must be an existing[/color]
function[color=blue]
> along the lines of: valid_charset($ str_blah, "iso-8859-01") or somesutch?!
>
> Here's hoping...
>
> Plankmeister.
>
>[/color]

Ok... I think this should work, (it certainly seems to, and I've tested it
for an inordinately long time...) but is there anything I'm overlooking?

function valid_string($s tr_to_check)
{
return (!preg_match("/^&#[256-999]|[1000-9999];$/", $str_to_check) ?
true : false);
}