Field specificity and absolute validation of the replied values should be the first level of defense. Whenever a public form is created, you create the inputs with as much specificity as possible, then validate strictly against this specificity. The HTML5 specification has made this much easier with the expansion of the types of input fields.
For example, if you are asking for a user’s age, use an input with ‘type=“number”’ and ‘step=”1” min=”5” max=”120”’ instead of a simple ‘type=”text”’. This forces the user to input an integer between 5 and 120 (max range of legitimate possible ages of a user) otherwise the form field should indicate it is an illegal value and prevent submission of the form. Then on the server side, you validate strictly against these criteria, immediately tossing any submission that contains an invalid value. There is an added bonus as the error messages for HTML5 compliant browsers don’t need to be as robust, since the user already should have received an error when they attempted to input the field the first time.
Example Validation Function
//! Validate input value of a Number Input
//! @param string $input Inputted value
//! @param int $min Minimum Value @default[0]
//! @param int $max Maximum Value @default[100]
//! @param string $step Incremental increase between minimum and maximum value @default[1]
//! @success string Returns inputted value on success (including potentially 0)
//! @failure FALSE Returns FALSE on validation failure
function validateInputNumber($input, $min = 0, $max = 100, $step = 1) {
// verify all inputs are numbers
if(!is_numeric($input)
|| !is_numeric($min)
|| !is_numeric($max)
|| !is_numeric($step)
) {
return FALSE;
}
// verify $input is within appropriate range
if($input < $min || $input > $max) return FALSE;
// check that $input is at a valid step position
$inc = ($input - $min) / $step;
if($inc != intval($inc)) return FALSE;
// all checks passed, return $input
return $input;
}
// example pass ($input == ’32.5’)
$input = validateInputNumber(’32.5’, 0, 100, 2.5);
// example fail ($input === FALSE)
$input = validateInputNumber(’32’, 0, 100, 2.5);
A complete list of the HTML5 input fields can be found at MDN:
https://developer.mozilla.org/en-US/docs/Web/HTML/Element/input