PHP code how to clean user input from $_POST

Question

I have this PHP code:

<?php
    $score11 = $_POST['passmarks12'];

    if($_POST['passmarks12'] > 100){
        $grade11 = "";
    }
    elseif ($_POST['passmarks12'] < 45){
        $grade11 = "Fail";
    }
    $strg = " $grade11";

    echo $strg;

?>

The code is always printing "Fail" regardless of what is sent in.

I want it so that if it passes in blank or invalid input it fails.

And how should I properly cleanse the input?

If you can't trust the inputs to be valid, you check them _before_ doing anything else. — Dek Dekku, May 19 '13 at 08:49

score 1 · Answer 1 · answered May 19 '13 at 08:52

Try this:

<?php

    //$_POST['passmarks12'] = '';

    if(empty($_POST['passmarks12']) || $_POST['passmarks12'] > 100)
    {
        $grade11 = "";
    }

    else if ($_POST['passmarks12'] < 45){

        $grade11 = "Fail";
    } else{
            $grade11 = "Pass";
    }
    $strg = " $grade11" ;

    echo $strg;

    ?>

mpyw · Answer 2 · 2013-05-19T09:01:40.743

Points:

Check if $_POST['key'] exists using isset.
Check if $_POST['key'] has a valid data type, string.
It may come as array.
Check if $_POST['key'] has a valid numeric format.
Compare $_POST['key'](String) and 45(Integer), using intval.

Example:

<?php

switch (true) {

    case !isset($_POST['passmarks12']):
    case !is_string($score = $_POST['passmarks12']):
    case !is_numeric($score):
        $result = 'Error (Invalid parameter)';
        break;
    case (intval($score) < 45):
        $result = 'Fail (Less than 45)';
        break;
    default:
        $result = 'Success (No less than 45)';

}

echo $result;

score 0 · Answer 3 · answered May 19 '13 at 08:48

0

I think you want

elseif ($_POST['passmarks12'] < 45 && !empty($_POST['passmarks12']))

answered May 19 '13 at 08:48

1

Those should be the other way around, otherwise you get an error if `$_POST['passmarks12']` isn't set. – rpkamp May 19 '13 at 08:52

score -1 · Accepted Answer · edited Jul 24 '13 at 17:37

-1

This PHP code will make sure $_POST is not empty before comparing it to 100.

<?php
    $score11 = $_POST['passmarks12'];

    if(empty($_POST['passmarks12']) || $_POST['passmarks12'] > 100)
        $grade11 = "";

    elseif ($_POST['passmarks12'] < 45)
        $grade11 = "Fail";

    $strg = " $grade11" ;

    echo $strg;

?>

edited Jul 24 '13 at 17:37

Eric Leschinski

146,994
96
417
335

answered May 19 '13 at 08:49

Meeran

77
2

PHP code how to clean user input from $_POST

4 Answers4

Points:

Example: