Zend Framework 2 MultiCheckbox and validatiors

Question

Is there a way to validate an instance of Zend\Form\Element\MultiCheckbox using the Zend validators such as Zend\Validator\Digits?

I'm finding the existing Zend validators do not account for the fact that the selected value(s) is an array.

I found a reference here (http://zf2.readthedocs.io/en/release-2.2.7/modules/zend.form.element.multicheckbox.html) that the FormMultiCheckbox helper (https://framework.zend.com/manual/2.4/en/modules/zend.form.view.helper.form-multicheckbox.html) can be used to add an InArray validator to the element, but I'm not sure how that helps other types of validators. My usages show that it doesn't.

I realize I can extend the Zend Validators to account for the array, but I feel there has to be a way to do this which works with the rest of ZF2 out-of-the-box. If there isn't a way then I'll extend the validators, but I much rather use the out-of-the-box validators whenever possible.

Using:
zendframework/zend-form: 2.10.2
zendframework/zend-validator: 2.10.1

What are you trying to validate? Each of the Zend Validators (and any that you create yourself) evaluate user input against certain criteria. Are you trying to validate whether a box was checked? ... whether multiple boxes were checked? ... whether a specific number of boxes were checked? ... whether the boxes that were checked are members of a specific collection? ... whether the boxes that were checked have a specific relationship? — jcropp, Apr 27 '18 at 03:40
@jcropp I want to validate the checked values. In particular I want to verify they are all digits. I don't care how many options were checked; It could be zero or it could be all. Besides, there's plenty of examples showing how to do so. — d.lanza38, Apr 27 '18 at 13:01

jcropp · Accepted Answer · 2018-05-02T16:41:40.300

The Multicheckbox form element will only return the values that you define yourself, so there's no need to validate the values as long as you configure it correctly. The ZF3 Documentation gives the following example:

use Zend\Form\Element;
use Zend\Form\Form;

$multiCheckbox = new Element\MultiCheckbox('multi-checkbox');
$multiCheckbox->setLabel('What do you like ?');
$multiCheckbox->setValueOptions([
        '0' => 'Apple',
        '1' => 'Orange',
        '2' => 'Lemon'
]);

$form = new Form('my-form');
$form->add($multiCheckbox);

This element will always return an array of strings ('0', '1', and/or '2'). The element can also be written like this:

use Zend\Form\Element;
use Zend\Form\Form;

$multiCheckbox = new Element\MultiCheckbox('multi-checkbox');
$multiCheckbox->setLabel('What do you like ?');
$multiCheckbox->setValueOptions([
        0 => 'Apple',
        1 => 'Orange',
        2 => 'Lemon'
]);

$form = new Form('my-form');
$form->add($multiCheckbox);

This element will always return an array of integers (0, 1, and/or 2), and you don't need to validate to confirm that the selected values are integers.

UPDATE

For added security (in case there's a threat that users might try to change the values you coded in your multicheckbox code), the InArray validator can be used to indirectly validate that the inputs are digits by confirming that they are members of an array of the whitelist digits-only values that are the same that you included in your multicheckbox digit values.

Thank you @jcropp . Yes, I understand the values are pre-populated as dictated by the code. However, there is nothing stopping a user from inspecting the element and changing those values prior to submission. If I don't validate the selected values then that would leave my code open to attack. I could probably proceed without validating and be fine, but I'd rather not take that chance. — d.lanza38, Apr 30 '18 at 12:37
For cases where users aren't trying to change the values in your multicheckbox code, you don't need to validate because you coded them as integers. If you're concerned that users ARE trying to change the values you coded in your multicheckbox code, it seems like the InArray validator really does work for you: it doesn't directly validate whether the inputs are digits; but it indirectly validates that the inputs are digits by confirming that the inputs are members of an array of only digits that you have specified to match your multicheckbox digit values. — jcropp, May 02 '18 at 06:22
All right thanks. Looks like the only options are to validate against whitelisted values using the inArray validator or to extend the validators shipped with the ZF packages. If you update your answer to reflect this I'll go ahead and mark it as accepted. — d.lanza38, May 02 '18 at 15:56

Zend Framework 2 MultiCheckbox and validatiors

1 Answers1