validation of posted data.

[hostux]

hi again peeps, here is a bit of code i wrote to strip usernames of all illegal characters

 elsif ($display !~ /^\w*$/) {
    $message = $message.$errmsg ;
    $found_err = 1 ; }

currently this does not allow . in usernames. would someone please be able to re-write this to allow . thanks James

[DamnDirtyApe]

It's already been said here, but it's worth saying again:

Don't try to exclude all `illegal' or `invalid' characters. You'll never get them all. Instead, decide what you will accept, and make sure your input contains that, and nothing else.

I'd write your regexp something like this:

unless ( $display =~ /^[a-z0-9\-\.]+$/ )
{
    # Invalid input
}


_______________
D a m n D i r t y A p e
Home Node | Email

[Cine]

I've found

if ($display =~ /[^\-a-z0-9\.]/) {
  #err
}

to be easiere to read most of the time.
Also if you _read_ the code, Yours says: unless $display is all good chars make an error. Where this says: If there are any illegal chars make an error. I find the latter easiere to understand.

T I M T O W T D I

[BorgCopyeditor]

Kind of a tangent, here, but isn't "." acceptable by itself (i.e., unescaped) in a character class, since its function as a metacharacter there wouldn't make much sense?

BCE
--Your punctuation skills are insufficient!

[jeffa]

Use a character class: /^[\w.]+$/

use strict;

my @user = map { 'foo'.$_.'bar' } qw(! @ # $ % ^ & * ( ) _ .);

for (@user) {
   print /^[\w.]+$/ 
      ? "$_ is legal\n"
      : "$_ is illegal\n"
   ;
}

jeffa

L-LL-L--L-LL-L--L-LL-L--
-R--R-RR-R--R-RR-R--R-RR
B--B--B--B--B--B--B--B--
H---H---H---H---H---H---
(the triplet paradiddle with high-hat)

[Cine]

I doubt \w is appropiate in this context, since usernames almost never may contain unicode chars or locale dependant chars ;)

T I M T O W T D I

[amir]

The best thing to do, as CERT recommends, is to "sanitize" and only allow what you need:

$_ = "the\\/bad\$dataStuff"; # your data of course :)
$OK_CHARS='-a-zA-Z0-9_.@'; # allowed characters
s/[^$OK_CHARS]/_/go; # replace invalid chars with _
$user_data = $_; # sanitized version
print $user_data;
# output: the__bad_dataStuff

Excellent article from CERT.

[fs]

I'd suggest that you verify that it only contains valid characters. So if your usernames can contain alpha and '.' only, you could use something like (untested):

if($display =~ /[^a-b\.]/i){
    # error condition here
}

Modify the regex to add additional conditions to suit your exact needs.

[demerphq]

A minor point but your regex allows "" (the empty string) to be used as a valid username.

Yves / DeMerphq
---
Writing a good benchmark isnt as easy as it might look.

[Anonymous Monk]

hi there, i have a seperate piece of code to validate blanks anlong with usernames > 20 < 3 chars

[demerphq]

All of that can be done in a regex:

/\A\w{3,20}\z/

Will match only word sequences that are 3 to 20 characters long ONLY.

Yves / DeMerphq
---
Writing a good benchmark isnt as easy as it might look.