Zikula Community

• **unknown user**
  
  

  • Rank: Helper
  • Registered: Mar 16, 2002
  • Last visit: May 18, 2010
  • Posts: 985

  Posted: May 09, 2007 - 05:44 AM

  I'm expanding the pnWebLog 0.4 module, so anon users can post a comment in the guestbook [or comment on the webLog_Post, with anti-spam feature, I've added two fields
  

  Code

  pn_email varchar(60)        
  pn_http varchar(254)

  
  and use
  

  Code

  '" .pnVarPrepForStore($email) . "','" .pnVarPrepForStore($http) . "',

  
  
  This should be 'save' enough? If it is, then it's working perfectly...
  
  - Igor

  • 
  •  
• markwest
  
  

  • Rank: Team Member
  • Registered: Mar 18, 2002
  • Last visit: Oct 21, 2009
  • Posts: 6606

  Posted: May 09, 2007 - 05:50 AM

  This should be enough to prevent any attempted hacks using this code. You *may* wish to validate the input a bit futher using pnVarValidate - usage pnVarValidate($var, $type)
  
  e.g. pnVarValidate($myvar, 'email') and pnVarValidate($myvar, 'URL').
  
  -Mark
  
  
  --
  Visit My homepage and Zikula themes.

  • 
  •  
• **unknown user**
  
  

  • Rank: Helper
  • Registered: Mar 16, 2002
  • Last visit: May 18, 2010
  • Posts: 985

  Posted: May 09, 2007 - 08:57 AM

  Done, as suggested...
  BTW
  

  Code

  // validate email address
  if (!pnVarValidate('john.doe@example.com', 'email')) {
      die('email address is incorrect format');
  }
  // validate url
  if(!pnVarValidate('http://www.example.com','url')) {
      die('URL is invalid');
  }

  
  
  if one is using pnVarValidate('$stringwhatever','email'), that doesn't work, it has to be pnVarValidate($stringwhatever,'email')
  Maybe http://bjorsq.net/pnHelp/api.function.pnVarValidate.html should be updated.
  
  
  Working link:
  http://www.forul.be/index.php?module=WebLog&func=guestbook&uid=2
  [Lay-out is not pretty... I know ]
  
  - Igor

  • 
  •  
•  
•  

Users on-line

• mazdev,
• mesteele101

This list is based on users active over the last 60 minutes.