Max Length

Discussion in 'PHP' started by oo7ml, Jun 19, 2007.

0
  1. #1
    If i set the maxlenght on a input box on my form to:

    <input type="text" name="firstname" size="35" maxlength="15">
    HTML:
    Is there a way a hacker or user can get around it. The reason i ask is becasue i have:
    
if (!preg_match('/^[a-z0-9]{5,15}$/i', $username))
    PHP:
    in my validation, can i leave out the 15 in this because i have my maxlength set on my form
     
    oo7ml, Jun 19, 2007 IP
  2. Cesay

    Cesay Peon

    Messages:
    121
    Likes Received:
    9
    Best Answers:
    0
    Trophy Points:
    0
    #2
    No, you should leave the max length regex because forms are the easiest thing to spoof. :) Anyone could copy your source, remove the max length tag, and post to your page so it's always best to have server-side checks too.
     
    Cesay, Jun 19, 2007 IP
  3. oo7ml

    oo7ml Well-Known Member

    Messages:
    656
    Likes Received:
    2
    Best Answers:
    0
    Trophy Points:
    105
    #3
    ok, thanks a million
     
    oo7ml, Jun 19, 2007 IP
  4. nico_swd

    nico_swd Prominent Member

    Messages:
    4,153
    Likes Received:
    344
    Best Answers:
    18
    Trophy Points:
    375
    #4
    Yes, you have to verify ALL input on the server side. Never on the client's side.

    Don't ever trust the user.
     
    nico_swd, Jun 19, 2007 IP
  5. HuggyCT2

    HuggyCT2 Guest

    Messages:
    222
    Likes Received:
    2
    Best Answers:
    0
    Trophy Points:
    0
    #5
    You can just use:

    
<?php
$var = strlen($_POST['var']); // counts the characters

if ($var > 15)
{
echo "Too Long";
}
?>
    PHP:
     
    HuggyCT2, Jun 19, 2007 IP