B09 | Validate before trusting and escape before displaying
Basic level · Lesson B09
B09 | Validate before trusting and escape before displaying
Result: form with clear errors and safe output.
Core concept: validating input and escaping output solve different problems.
Guideline time: 100–130 minutes.
Why does a “required” field still need PHP validation?
Because any request can be modified outside the form. The server must check presence, type, range and rules. Then, when displaying text, you must encode it for the HTML context.
Previous connection
We will protect the form of B08.
Guided laboratory
<?php
$rawHours = $_POST['hours'] ?? null;
$errors = [];
$hours = filter_var($rawHours, FILTER_VALIDATE_INT, [
'options' => ['min_range' => 1, 'max_range' => 40],
]);
if ($_SERVER['REQUEST_METHOD'] === 'POST' && $hours === false) {
$errors['hours'] = 'Escribe un número entre 1 y 40.';
}
?>
When printing user-supplied text use htmlspecialchars($value, ENT_QUOTES, 'UTF-8').
Medium Mission
Validate alias name, topic and hours. Display a message next to each field and preserve safe values. Try characters like < and &.
University Extension
Build separate normalization, validation and escape functions. Defines an input-rule-error matrix and explains why filtering is not a substitute for domain modeling.
Tests
Empty, minimum, maximum, out of range, decimal, text and HTML characters.
Delivery
Send matrix, code, evidence of six cases and explanation between validate and escape. SEND TO TUTOR.
Next: B10 — Basic project.
Comments
Post a Comment