Have Geek Brain

Is there a way to automatically filter getRequest () parameters in Zend?

I really don't want to call the Zend filter in my code after every getRequest-> getParam ('x') unless I need to. Is there a lazy way to magically filter everything inside getRequest?

Edit: When I say filter, I mean escaping tags, clearing XSS, and escaping any sql escape characters.

i.e:

$myVar = $this->getRequest()->getParam('x');
filter the variable, escape sql stuf... etc

What standard? How do you do it?

+1


a source to share


4 answers


There are several ways to handle your situation.

First of all, you can get all parameters at once:

$params = $this->_request->getParams(); //_request is equivalent to getRequest()


So the lazy way to filter all of your parameters was to use ***** when declaring your filters, which means all fields, and would look something like this:

$filters = array('*' => array('StringTrim','HtmlEntities','StripTags'));
$input = new Zend_Filter_Input($filters,$validators,$params);
if($input->isValid()) {
     //blah blah blah
}

You should read more about the request object , as well as filters , input filters, and validators .

+6


a source


The only way is to do it all.



  • use Zend_Filter_Input

    (as noted above, karim79) to filter information about how they should be stored or viewed (stripping tags with StripTags

    , discarding on Int

    , StringTrim

    etc.), checking where validation is needed, but not htmlentities, since this should probably be done in the output to avoid complications in finding db etc. In most cases, margins need to be individually rotated / checked.

  • use parameterized queries ( Zend_Db_Select

    with? placeholders) always or at least use db highlighting functions

  • delete all output if necessary ( Zend_View_Helper_Escape

    → $this->escape()

    ).

+1


a source


Karim79's answer covers grab the parameters in a single array.

Typically, a Zend_Filter is not required to clean up data for every request.

To prevent XSS, you should avoid displaying data in the view:

$this->escape($someUserSuppliedData)

and when working with Zend_Db, some methods like insert and update will fetch the data for you. When building queries by hand, you can use Zend_Db functions such as quote

0


a source


Perhaps he is looking for a way to overload the getRequest () method and then filter the request object inside the newly created method.

Check out: http://framework.zend.com/manual/en/zend.controller.plugins.html

Then you can simply use the Zend_Filter class, or create your own filter class by overloading the above.

0


a source






More articles:


All Articles