-1

I'm using strlen to check my inputs values. I want to forbid to the users to send data to my database if the strlen is too long. I didn't find any way to forbid it, so anyone can send as long values as he wants right now. Here's my code:

if (isset($_POST['sub'])) {
    $name = $_POST['name'];
    $phone = $_POST['phone'];
    $phone2 = $_POST['phone2'];
    $email = $_POST['email'];
    $zipcode = $_POST['zipcode'];
    $address = $_POST['address'];
    $job = $_POST['job'];
    $description = $_POST['description'];
    $userid = $_SESSION['id'];

    $stmt = $mysqli -> prepare('UPDATE cards SET name=?, phone=?, phone2=?, email=?, zipcode=?, address=?, job=?, description=?, visibility=?, confirmed=?  WHERE id = ?');

    if (
        $stmt &&
        $stmt->bind_param('ssssisssiii', $name, $phone, $phone2, $email, $zipcode, $address, $job, $description, $visibility, $confirmed, $id) &&
        $stmt -> execute()
        ) {
          echo "Sikeres módosítás!";
    } else {
        echo $mysqli -> error;
    }

} 
$getstmt = $mysqli->prepare("SELECT * FROM cards WHERE id= ?");

if ($getstmt and
    $getstmt->bind_param('i', $id) and
    $getstmt->execute() and
    $result = $getstmt->get_result() and
    $row = $result->fetch_assoc()
    ) {

      if($row['userid'] == $_SESSION['id']){
        $name = $row['name'];
        $phone = $row['phone'];
        $phone2 = $row['phone2'];
        $email = $row['email'];
        $zipcode = $row['zipcode'];
        $address = $row['address'];
        $job = $row['job'];
        $description = $row['description'];
    }else{
        header("Location: index.php");
    }

I check the length of inputs here:

if(strlen($name) > 30)
    {
        echo "test";
        exit();
    }
    if(strlen($job) > 50)
    {
        echo "test";
        exit();
    }
    if(strlen($email) > 50)
    {
        echo "test";
        exit();
    }
    //more of these strlen checks
//and html code under that

How can I modify the echo parts to forbid to send the datas?

6
  • Why is this tagged with sql?
    – Caius Jard
    Feb 24, 2020 at 20:20
  • Sorry, removed that.
    – Mower
    Feb 24, 2020 at 20:22
  • What isn't working the way you would like it to? Feb 24, 2020 at 20:30
  • I couldn't find any solution to forbid the data sending progress if the strlen is too long. That's what I'd like to put instead of "echo" stuffs.
    – Mower
    Feb 24, 2020 at 20:33
  • I can't see how what you posted could fail. Unless the form and/or inputs are correct or you didn't assign the variables to POST arrays, it's unclear/unknown as to why it isn't working the way you'd like it to. Someone posted an answer below. Not sure if it will still be there but I posted a comment under it saying that that wasn't what the question was about. @Mower Feb 24, 2020 at 20:35

1 Answer 1

1

Well, if you really have to do it your way, you can throw an exception.

However, more common way is to bind your data to model, validate the model checking any business constraints (using the validator) and then acting accordingly. There is plenty of web frameworks providing such an abstraction in any programming language, for PHP see Laravel for inspiration.

3
  • That isn't what they're asking. Feb 24, 2020 at 20:30
  • I have no idea how I should use an exception here.
    – Mower
    Feb 24, 2020 at 20:44
  • (1) You can enforce datatype checking in database with proper table definitions. If so, your application will receive a SQL error if someone will try to write longer string than allowed for example -- to your application this is usually an error it can not handle. Or (2) you can check it yourself -- just as you do -- and stop processing the request if there is an error. This approach allows you to react more accordingly (better user experience). Throwing an exception will require to catch it and show a different HTML if there is an error. Ok?
    – bubak
    Feb 24, 2020 at 20:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.