1

I am creating SQL query based on user input:

// user input
$amount = '20';

// query in zend 
$select->where('amount = ?', $amount );

Now according to new requirements user can input in following formats as well:

$amount = '20';
$amount = '<20';
$amount = '<=20';
$amount = '>20';
$amount = '>=20';
$amount = '=20';

I think you understand the new feature. So how can I parse $amount variable to fit it in above query? I have to separate number and sign from $amount variable to use them on their proper position. And if there is wrong sign(i.e $amount='$%20'; ) then it should consider it as equal sign(i.e $amount='=20'; )

What approach should I follow to solve this?

Thanks

4
  • first, assume all inputs are correct and rewrite $select->where('amount = ?', $amount ); to $select->where('amount ?', $amount );, does it solve your problem? if yes then you can find the integer values out of the input by using a small regex, some thing like '[0-9]*', strip off the input using the int values you have
    – Kumar
    Jun 30, 2011 at 10:06
  • Yes. But user can enter wrong sign(i.e $amount='$%20'; ) as described in my question.
    – Awan
    Jun 30, 2011 at 10:10
  • can a user input arbitrary number of characters? Can I input a complete copy paste a complete web page in the input?
    – Kumar
    Jun 30, 2011 at 10:14
  • It will be always like (signs)(numbers)
    – Awan
    Jun 30, 2011 at 10:18

3 Answers 3

2
$parts = array();
if (preg_match('/^(\D+)?(\d+)$/', $amount, $parts)) {
    $operator = (!in_array($parts[1], array('=', '<', '<=', '>=', '>'))) ? '=' : $parts[1];
    $value    = $parts[2];
    $select->where('amount ' . $operator . ' ?', $value );
}
6
  • +1 Much cleaner solution than mine. Why did I use a second regex when there is in_array() :).
    – kapa
    Jun 30, 2011 at 10:22
  • Where are you setting value of $parts[2]. In 3rd line, there is no $parts[2]. Is it a typo ?
    – Awan
    Jun 30, 2011 at 10:37
  • $parts contains 3 keys after the preg_match call. 0 is the whole match (not needed), 1 is the captured match from the first parenthesis pair and 2 is the captured match from the second parenthesis pair. Jun 30, 2011 at 10:39
  • @Stefan Gehrig: Working perfectly.Thanks.
    – Awan
    Jun 30, 2011 at 11:36
  • @Stefan Gehrig: There is a small problem. It is not working when there is a floating point number. For example: >45.15 or =10.00. It was not included in my question. Sorry for that. Do you have a quick solution. Thanks
    – Awan
    Jun 30, 2011 at 11:47
2

You could use the following regex to separate them:

preg_match('/(<|>|=|<=|>=)([0-9]+)/', $amount, $matches);
$sign=$matches[1];
$number=$matches[2];

UPDATE: I have tested this and found that it does not handle erroneous signs properly. I came up with the following code which seems to work fine:

$amount=">=20";
preg_match('/([^0-9]*)([0-9]+)/', $amount, $matches);
$sign=preg_match('/^(>|<|=|<=|>=)$/', $matches[1]) ? $matches[1] : '=';
$number=$matches[2];

If the string given is >=20 then sign is >= and number is '20', if the string given is '%$20' then sign is = and number is 20.

4
  • will it take care of %^$%^ 20?
    – Kumar
    Jun 30, 2011 at 10:13
  • Alternatively, /([<>]?=?)([0-9]+)/
    – jensgram
    Jun 30, 2011 at 10:13
  • $matches[0] does not contain the operator but rather the complete match. The captured parts are in $matches[1] and $matches[2] respectively. Furthermore this doesn't cover the case where no operator is specified. Jun 30, 2011 at 10:15
  • @Stefan Yes it was a typo. Updated my answer after testing my "solution". Now it should work fine.
    – kapa
    Jun 30, 2011 at 10:20
1

If user can specify operator with value you have to be careful. Try with:

$input = '<=20';
$allowedOperators = array('<', '<=', '>', '>=', '=');

if ( in_array(substr($input,0,2), $allowedOperators) ) {
    $operator = substr($input,0,2);
} else if ( in_array(substr($input,0,1), $allowedOperators) ) {
    $operator = substr($input,0,1);
} else {
    $operator = '=';
}

$amount = (int) substr($input, strlen($operator));

$select->where('amount ' . $operator . ' ?', $amount );
2
  • Thanks. This solution is little bit long but flexible. I can add more options in $allowedOperators array in future. I will try this also.
    – Awan
    Jun 30, 2011 at 10:43
  • There are some issues: I tried $input=^&21 then output is servicerecord.TotalFees = 0. It should be servicerecord.TotalFees = 21
    – Awan
    Jun 30, 2011 at 11:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.