ExpressionEngine->validate $_POST variables in template

Question

The following code is for a template that handles the forgot password section of our website. (Please don't berate me for it's stupidity, I didn't write it) What I need to do is embed '/inc/forgot_password_form' with a message of 'Your PID must be numeric' if the $_POST['PID'] has non numeric chars. How would I modify this code to do that?

I know I can do it client-side using my jQuery validator but I'd rather do it here because I can also check a minimum value and show a special message for it.

{if segment_2 == 'submit'}
<?
  $embed_params = 'EmailAddress="' . $_POST['EmailAddress'] . '" PID="' . $_POST['PID'] . '" ';
?>
{embed='/inc/forgot_password_form' message='{exp:forgot_password:send_email code="{segment_3}" <?=$embed_params?>}' <?=$embed_params?>}
{if:elseif segment_2 == 'reset'}
{embed='/inc/forgot_password_reset' email='{exp:forgot_password:check_code code="{segment_3}" }'  code="{segment_3}"}
{if:elseif segment_2 == 'reset_submit'}
{embed='/inc/forgot_password_reset' message='{exp:forgot_password:update_password code="<?=$_POST['code']?>"  password="<?=$_POST['password']?>" }' }
{if:else}
{embed='/inc/forgot_password_form' }
{/if}

Edit with new code:

So you are saying to do it like this?

{if segment_2 == 'submit'}
<?
  $embed_params = 'EmailAddress="' . $_POST['EmailAddress'] . '" PID="' . $_POST['PID'] . '" ';
  if (!is_int($_POST['PID']) {
      {embed='/inc/forgot_password_form' message='You submitted an invalid Member #.' <?=$embed_params?>}
  } else {
      {embed='/inc/forgot_password_form' message='{exp:forgot_password:send_email code="{segment_3}" <?=$embed_params?>}' <?=$embed_params?>}
  }
?>
{if:elseif segment_2 == 'reset'}
{embed='/inc/forgot_password_reset' email='{exp:forgot_password:check_code code="{segment_3}" }'  code="{segment_3}"}
{if:elseif segment_2 == 'reset_submit'}
{embed='/inc/forgot_password_reset' message='{exp:forgot_password:update_password code="<?=$_POST['code']?>"  password="<?=$_POST['password']?>" }' }
{if:else}
{embed='/inc/forgot_password_form' }
{/if}

Philip Zaengle · Accepted Answer · 2012-04-23T21:26:16.093

1

Doing this via PHP is very simple, just you the is_int function.

if (is_int($_POST['PID'])){

// do this code

}
else{

// Do this code

}

edited Apr 23 '12 at 21:26

answered Apr 23 '12 at 21:06

Philip Zaengle

947
4
10

score 0 · Answer 2 · answered Apr 24 '12 at 14:17

Philip's answer is a good one, but I thought I'd share a snippet of code that might help you if you're working with GET/POST variables a lot. It stores all GET and POST variables as EE global variables. I have this stored in my bootstrap file (system/config.php), but you could also add this to system/expressionengine/config/config.php:

// Turn $_GET into global variables
foreach ($_GET as $key => $value) {
  $default_global_vars['get:' . $key] = $value;
}

// Turn $_POST into global variables
foreach ($_POST as $key => $value) {
  if(!is_array($value)) {
    $default_global_vars['post:' . $key] = $value;
  }
}

With this code in place, you could refer to the PID field as {post:PID} instead of as $_POST['PID']. It's not entirely applicable to your situation, since you'll probably be using PHP in your template to validate the PID. However, you should ideally write or find an EE plugin to do that for you and keep PHP out of your templates. The above code snippet helps dramatically with that goal anytime you're working with forms.

Also, pardon the non-answer, but it was too big to leave as a comment.

this does this for all GET/POSTs in the entire site? Even in 3rd-party plugins? — MB34, Apr 24 '12 at 15:03
This should work for all GET/POST values that get submitted via a form, regardless of what code was used to submit them. — Ray Brown, Apr 24 '12 at 17:01

ExpressionEngine->validate $_POST variables in template

2 Answers2