- ME PEZ - Flying into Formation

Tutorial 3 - Part II -Flying into Formation - page 7

Before you clean up your form, there's a few more points to cover. For some coders, protection from injection isn't quite enough, so they have 'if eregi' checks that outlaw all input except what would be required. For example, for your first name input, only letters (either small or capitalized) would be needed - plus maybe a period (.) for those who use initials. For last names, you might need to allow a few extra characters, like the hyphen ('-') and the single quote (') for last names like "O'Malley-Jones." Everything else you can outlaw.

Other coders don't like to receive blank inputs, so they add an 'if empty' check similar to your check for an empty form using pipes ('||') in place of ampersands ('&&'):

if (empty($first) || empty($last) || empty($email) || empty($comment)) {
echo ('Please fill in all input boxes.');
}

In this form, however, I have assumed that you only need a comment. So after your empty-form check, I would add the following code:

if (empty($comment)) {
echo ("You haven't entered a comment. Without a comment, this form cannot be processed. To enter a comment, hit the 'back' button on your browser, fill in your comment and resubmit. Thank you.");
exit;
} else {

The above code will require a comment before the form can be sent. You might also want to check your form inputs to make sure they are what is expected. The code below does this while outlawing any unexpected characters for those inputs that are not left blank:

if (!empty($first)) {

if (!eregi ("^[[:alpha:].' -]{1,25}$",stripslashes(trim($first)))) {
$firstone = "3";
echo 'But, your first name, ' . ($first) . ', is NOT composed of just alphabetic characters.
This form is designed to accept a first name that is either blank or composed wholly of alphabetic characters and certain non-alphabetic characters commonly used in names.
You are reading this message because your first name included non-alphabetic characters not normally associated with common names.
If you made a mistake in entering your first name and wish to complete this form, or if you just wish to complete this form, please hit the "back" button on your browser.
This will return you to your form.
Then either leave the first name blank or enter a first name composed of alphabetic characters and characters normally associated with common names. Thank you. And firstone = ' . ($firstone) . '.';
exit;
} else {
if (eregi ("^[[:alpha:].' -]{1,25}$",stripslashes(trim($first)))) {
$firstone = "0";
echo 'Your first name is ' . ($first) . ' And firstone = ' . ($firstone) . '.';
}
}
}

if (!empty($last)) {

if (!eregi ("^[[:alpha:].' -]{1,25}$",stripslashes(trim($last)))) {
$lastone = "3";
echo 'But, your last name, ' . ($last) . ', is NOT composed of just alphabetic characters.
This form is designed to accept a last name that is either blank or composed wholly of alphabetic characters and certain non-alphabetic characters commonly used in names.
You are reading this message because your last name included non-alphabetic characters not normally associated with common names.
If you made a mistake in entering your first name and wish to complete this form, or if you just wish to complete this form, please hit the "back" button on your browser.
This will return you to your form.
Then either leave the last name blank or enter a last name composed of alphabetic characters and characters normally associated with common names. Thank you. And lastone = ' . ($lastone) . '.';
exit;
} else {
if (eregi ("^[[:alpha:].' -]{1,25}$",stripslashes(trim($last)))) {
$lastone = "0";
echo 'Your last name is ' . ($last) . ' And lastone = ' . ($lastone) . '.';
}
}
}

if (!empty($email)) {
if (!eregi ("^([[:alnum:]]|_|\.|-)+@([[:alnum:]]|\.|-)+(\.)([a-z]{2,4})$", stripslashes(trim($email)))) {
$eone = "3";
echo 'But, your email, ' . ($email) . ', is NOT a standard email address pattern.
This form is designed to accept an email that is either blank or composed of normal alphanumeric and certain non-alphanumeric email characters.
You are reading this message because your email address did not match the expected set of email characters.
If you made a mistake in entering your email and wish to complete this form, or if you just wish to complete this form, please hit the "back" button on your browser.
This will return you to your form.
Then either leave the email address blank or enter a standard email address. Thank you. And eone = ' . ($eone) . '.';
exit;
} else {
if (eregi ("^([[:alnum:]]|_|\.|-)+@([[:alnum:]]|\.|-)+(\.)([a-z]{2,4})$", stripslashes(trim($email)))) {
$eone = "0";
echo 'Your email is ' . ($email) . ' And eone = ' . ($eone) . '.';
}
}
}

Your altered "comment.php" will now look like this (click here). And your "comment.php" should act like this (click here). Now if someone fills in their last name as, for example, "#111111," they will be asked to leave this input blank or revise it (in case they misunderstood). This now makes it even more difficult for someone to abuse your form. You might also say that it makes much of the code you already wrote unnecessary - at least for these three form inputs. This is not entirely true however. We can cover this later. For now, let's just examine the above to better understand this code (and all code) and to become more comfortable working code. What we have is more "eregi" checks - checks for regular expressions. For email we have a specific regular expression check for an expression composed of several elements. First there is a check for the first element of an email expression - a check for alphabetic characters and/or numbers with possibly an underline, a period and/or a hyphen - ^([[:alnum:]]|_|\.|-). Second there is a check for the second element in an email expression - the "at" symbol (@). Third there is a check for the third element in an email expression - the period (.) followed by the fourth element of an email expression - the com or us or net, etc. - an alphabetic chain of between two and four characters - ([a-z]{2,4}). The plus symbols in the eregi expression seperate the different parts of the email. You would translate the pipe symbols (|) as the word "or" in above eregi email expression. This check is specific enough that no further eregi email check is necessary. In the case of the first and last name several checks may be necessary. The "if-statements" above check to see if the first name and last name form input is all alphabetic or is alphabetic with either periods, hyphens, or single quotes. (eregi ("^[[:alpha:].' -]{1,25}) between 1 and 25 characters in length.

At this point, however, the "name-eregi" check (check of the first and last name) does not stop an input of all periods or all hyphens or all single quotes. To do this a second "name-eregi" check needs to be added changing your code to:

if (!empty($first)) {

if (!eregi ("^[[:alpha:].' -]{1,25}$",stripslashes(trim($first)))) {
$firstone = "3";
echo 'But, your first name, ' . ($first) . ', is NOT composed of just alphabetic characters.
This form is designed to accept a first name that is either blank or composed wholely of alphabetic characters and certain non-alphabetic characters commonly used in names.
You are reading this message because your first name included non-alphabetic characters not normally associated with common names.
If you made a mistake in entering your first name and wish to complete this form, or if you just wish to complete this form, please hit the "back" button on your browser.
This will return you to your form.
Then either leave the firstname blank or enter a first name composed of alphabetic characters and characters normally associated with common names. Thankyou. And firstone = ' . ($firstone) . '.';
exit;
} else {
if (eregi ("^[[:alpha:].' -]{1,25}$",stripslashes(trim($first)))) {
$firstone = "0";
echo 'Your first name is ' . ($first) . ' And firstone = ' . ($firstone) . '.';
if (eregi ("^[.|'|-]{1,25}$",stripslashes(trim($first)))) {
$firstone = "2";
echo 'But your first name, ' . ($first) . ', does not
include any alphabetic characters. Because of this, your first name is considered an invalid name which causes this
form to shut down. This, in turn, changes firstone to ' . ($firstone) . '.';
exit;
}
}
}
}

if (!empty($last)) {

if (!eregi ("^[[:alpha:].' -]{1,25}$",stripslashes(trim($last)))) {
$lastone = "3";
echo 'But, your last name, ' . ($last) . ', is NOT composed of just alphabetic characters.
This form is designed to accept a last name that is either blank or composed wholely of alphabetic characters and certain non-alphabetic characters commonly used in names.
You are reading this message because your last name included non-alphabetic characters not normally associated with common names.
If you made a mistake in entering your last name and wish to complete this form, or if you just wish to complete this form, please hit the "back" button on your browser.
This will return you to your form.
Then either leave the last name blank or enter a last name composed of alphabetic characters and characters normally associated with common names. Thankyou. And lastone = ' . ($lastone) . '.';
exit;
} else {
if (eregi ("^[[:alpha:].' -]{1,25}$",stripslashes(trim($last)))) {
$lastone = "0";
echo 'Your last name is ' . ($last) . ' And lastone = ' . ($lastone) . '.';
if (eregi ("^[.|'|-]{1,25}$",stripslashes(trim($last)))) {
$lastone = "2";
echo 'But your last name, ' . ($last) . ', does not
include any alphabetic characters. Because of this, your last name is considered an invalid name which causes this
form to shut down. This, in turn, changes lastone to ' . ($lastone) . '.';
exit;
}
}
}
}

Of course you also will want to carry this one step further and do a similar set of eregi checks for your comment input. This will come out a little different. It will include a reversal of the code you're using and a new eregi check for any characters you may not have covered:

if (!empty($comment)) {

if (eregi ("^[a-zA-Z0-9\"\.' -?!%,:_\;\$\/]{1,}$",stripslashes(trim($comment)))) {
$commentone = "0";
echo 'Your comment is ' . ($comment) . ' And commentone = ' . ($commentone) . '.';
if (eregi ("^[0-9\"\.' -?!%,:_\;\$\/]{1,}$",stripslashes(trim($comment)))) {
$commentone = "2";
echo 'But your comment ' . ($comment) . ' , does not
include any alphabetic characters. Because of this, your comment is considered gibberish which causes this
form to shut down. So now commentone = ' . ($commentone) . '.';
exit;
}
} else {
if (!eregi ("^[a-zA-Z0-9\"\.' -?!%,:_\;\$\/]{1,}$",stripslashes(trim($comment)))) {
$commentone = "3";
echo 'But, your comment , ' . ($comment) . ', is either NOT composed of alphabetic characters or NOT composed of just alphabetic characters.
This form is designed to accept a comment composed wholely of alphabetic characters and certain non-alphabetic characters and punctuation marks commonly used in short comments.
Acceptable punctuation normally used in short comments include the quotation mark ("), the single quote ('), the question mark (?), the exclamation mark (!), the period (.), the comma (,), the colon (:) and the semicolon (;).
Acceptable non-alphabetic characters used in short comments include the underline, the hyphen (-), the percent sign (%), the dollar sign ($), the slash (/) and regular parenthesis ( ).
You are reading this message because your comment included non-alphabetic characters not normally associated with short comments and not included in the acceptable non-alphabetic character list above.
If you wish to complete this form, please hit the "back" button on your browser.
This will return you to your form.
Then enter a comment composed of alphabetic characters and the characters normally associated with short comments listed above. Thankyou. And commentone = ' . ($commentone) . '.';
exit;
}
}
}

Your altered "comment.php" will now look like this (click here). And your "comment.php" should act like this (click here). You'll notice that the code was reversed - instead of a negative eregi check (!eregi), the first "comment-check" is a positive check (eregi). This is done for convenience. Positive eregi checks are much easier to understand. However this, in turn, requires a third eregi check designed to catch all standard keyboard characters not yet covered - if (!eregi ("^[a-zA-Z0-9\"\.' -?!%,:_\;\$\/]{1,} . . . You'll also notice that the "comment-eregi" check allows for punctuation characters not needed when just filling out first and last names - [a-zA-Z0-9\"\.' -?!%,:_\;\$\/]. Many of these characters have to be escaped with a backslash. Other changes in the above code were needed to tweak the eregi expression into working properly. "Alnum," for example, had to be changed to "a-zA-Z0-9" - these two expressions may be considered synonyms for one another. And the bracket content had to be changed to "{1,}" to prevent a "BADBR" warning. This warning, as well as a "BADRPT" warning, is not uncommon when writing out eregi expressions from scratch. If this happens to you, don't get discouraged. A "BADBR" warning means that the content within the brace, or brackets, - { } - is invalid perhaps because the brace, or bracket, content is not a number or two numbers (as is expected). Or, if the brace, or bracket, content is a number or two numbers, that number doesn't, or those numbers don't, make sense. The reasons those numbers don't make sense may be because :

there are more than two numbers within braces, or brackets, or
the first brace, or bracket, number is larger than the second, or
one or both of the brace, or bracket, numbers is just too large (usually over 100).

A "BADBR" warning can result simply from white space within the braces, or brackets, of an eregi expression as in the following: ^[[:alpha:].' -]{1, 25} - notice the white space between {1, and 25}. Many times simply tweaking the expression will solve the problem and eliminate the "BADBR" and "BADRPT" warnings. By the way, a "BADRPT" warning results from an invalid use of the repetition operator. Other warnings you might come across are:

ERANGE (or, REG_ERANGE) - an out of memory warning or an "invalid character range" warning (because, for example, the ending point may come earlier than the starting point).
EPAREN (or, REG_EPAREN) - invalid use of parenthesis or a paraenthesis imbalance.
EBRACK (or, REG_EBRACK) - invalid use of rectangular brackets [ ] or a bracket imbalance.
EBRACE (or, REG_EBRACE) - invalid use of braces, or brackets, { }or a brace imbalance.
ECTYPE (or, REG_ECTYPE) - invalid or unknown character class name as in [[:unknown_name:]].

Other warnings are less likely to occur, but, when they do, look them up and tweak your eregi expression (and don't get discouraged).

A final point, the eregi check designed to catch characters not yet covered in your code is a sloppy way of writing code. So what probably should be done is the creation of a new set of eregi checks that cover those standard keyboard characters not yet covered in your code. Of course, you could always just add these characters to your list of characters outlawed to prevent spamming. However, it would be a misconception to imply that these characters have to be outlawed to prevent spammers from abusing your form. So a better solution is yet another set of eregi checks. In the end, the eregi check (above) designed to catch any keyboard characters not yet covered will never be used except to catch any non-standard keyboard characters that might get entered into your comments. This new set of eregi checks would look like this:

if (eregi("\|",$first) || eregi("\[",$first) || eregi("\]",$first) || eregi("\~",$first) || eregi("\`",$first) || eregi("\^",$first) || eregi("\*",$first) || eregi("&",$first) || eregi("\+",$first) || eregi("=",$first) || eregi("#",$first) || eregi("@",$first) )
{
$firstone = "1";
die('Certain standard keyboard characters are not needed to fill out the first name section of this form.
These unnecessary characters trigger this form to shut down to prevent their use in viruses, spam injections or other malware.
You are reading this message because you have used one, or more, of these characters. The list of
unnecessary characters are as follows: the pipe symbol (|), rectangular parenthesis ([]), the asterisk (*), the ampersand (&), the plus sign (+), the equal sign (=), the number or pound sign (#), the "at" symbol (@), and various other characters like ~, `, ^.
If you wish to complete this form, please hit the "back" button on your browser.
This will return you to your form.
Then enter a first name composed of alphabetic characters and non-alphabetic characters other than those listed above. Thankyou. And firstone =' . ($firstone) . '.');
}

if (eregi("\|",$last) || eregi("\[",$last) || eregi("\]",$last) || eregi("\~",$last) || eregi("\`",$last) || eregi("\^",$last) || eregi("\*",$last) || eregi("&",$last) || eregi("\+",$last) || eregi("=",$last) || eregi("#",$last) || eregi("@",$last) )
{
$lastone = "1";
die('Certain standard keyboard characters are not needed to fill out last name section of this form.
These unnecessary characters trigger this form to shut down to prevent their use in viruses, spam injections or other malware.
You are reading this message because you have used one, or more, of these characters. The list of
unnecessary characters are as follows: the pipe symbol (|), rectangular parenthesis ([]), the asterisk (*), the ampersand (&), the plus sign (+), the equal sign (=), the number or pound sign (#), the "at" symbol (@), and various other characters like ~, `, ^.
If you wish to complete this form, please hit the "back" button on your browser.
This will return you to your form.
Then enter a last name composed of alphabetic characters and non-alphabetic characters other than those listed above. Thankyou. And lastone = ' . ($lastone) . '.');
}

if (eregi("\|",$email) || eregi("\[",$email) || eregi("\]",$email) || eregi("\~",$email) || eregi("\`",$email) || eregi("\^",$email) || eregi("\*",$email) || eregi("&",$email) || eregi("\+",$email) || eregi("=",$email) || eregi("#",$email) )
{
$eone = "1";
die('Please find another way of entering your email. Certain standard keyboard characters are not needed to fill out the email section of this form.
These unnecessary characters trigger this form to shut down to prevent their use in viruses, spam injections or other malware.
You are reading this message because you have used one, or more, of these characters. The list of
unnecessary characters are as follows: the pipe symbol (|), rectangular parenthesis ([]), the asterisk (*), the ampersand (&), the plus sign (+), the equal sign (=), the number or pound sign (#) and various other characters like ~, `, ^.
If you wish to complete this form, please hit the "back" button on your browser.
This will return you to your form.
Then enter an email composed of alphabetic characters and non-alphabetic characters other than those listed above. Thankyou. And emailone = ' . ($emailone) . '.');
}

if (eregi("\|",$comment) || eregi("\[",$comment) || eregi("\]",$comment) || eregi("\~",$comment) || eregi("\`",$comment) || eregi("\^",$comment) || eregi("\*",$comment) || eregi("&",$comment) || eregi("\+",$comment) || eregi("=",$comment) || eregi("#",$comment) || eregi("@",$comment) )
{
$commentone = "1";
die('Please find another way of making your comment. Certain standard keyboard characters are not needed to fill out the comment section of this form.
These unnecessary characters trigger this form to shut down to prevent their use in viruses, spam injections or other malware.
You are reading this message because you have used one, or more, of these characters. The list of
unnecessary characters are as follows: the pipe symbol (|), rectangular parenthesis ([]), the asterisk (*), the ampersand (&), the plus sign (+), the equal sign (=), the number or pound sign (#), the "at" symbol (@), and various other characters like ~, `, ^.
If you wish to complete this form, please hit the "back" button on your browser.
This will return you to your form.
Then enter a comment composed of alphabetic characters and non-alphabetic characters other than those listed above. Thankyou. And commentone = ' . ($commentone) . '.');
}

Now your altered "comment.php" will look like this (click here). And your "comment.php" should act like this (click here). You can continue with these "eregi" conditionals ad infinatum. As an example, in the name sections of this form, you might add the following code:

if ((eregi ("[a-zA-Z]{1,}['|-]{1,}$",stripslashes(trim($last)))) | (eregi ("[a-zA-Z]{1,}[.]{2,}$",stripslashes(trim($last)))) | (eregi ("[.|'|-]{2,}[a-zA-Z]{1,}",stripslashes(trim($last)))) | (eregi ("^[.|'|-]{1,}[a-zA-Z]{1,}",stripslashes(trim($last))))) {

$lastone = "6";
echo 'But your last name, ' . ($last) . ', includes unnecessary non-alphabetic characters.
These non-alphabetic characters may have been placed inappropriately - say, at the beginning
of the name you entered or, in the case of the hyphen or single quote, at the end of the
name you entered. Or, perhaps you accidently held a key down longer than intended.
Whatever the reason, your last name has an inappropriately placed non-alphabetic character or
includes a repetition of non-alphabetic characters - either periods, single quotes, or hyphens.
This repetition of non-alphabetic characters or inappropriate placement of non-alphabetic
characters needs to be corrected before this form can be processed.
If you made a mistake in entering your last name and wish to complete this form,
or if you just wish to complete this form, please hit the "back" button on your browser.
This will return you to your form.
Then either leave the last name blank or enter a last name composed of alphabetic characters
and non-alphabetic characters in a manner appropriate to their use in common names. Thankyou.
This changes lastone to ' . ($lastone) . '.';
exit;

}

Using this type of code on both first and last names will result in a form that now acts like this (click here). This would change your code to this (click here). When we apply a similar set of eregi checks to the comment section of the form the result is a little different because the comment section is preceded by a different set of eregi checks. With a few extra checks, we can get similar results. We could also break the comment section down into words, or what should be words, by adding the following code:

$wordarray = explode(' ', $comment); echo count($wordarray);
echo '<pre>';
print_r($wordarray);
echo '</pre>';

We might be able to check these "words" to see if they exist in an online dictionary. We might be able to verify that these "words" are really words. We might be able to check for a particular word, say the word "problem," and use it to set priorities to the comments we receive. We might be able to similarly break the comment section down in a sentence array, to check each sentence to see if each has a noun and a verb. Surely, if we wanted, we could check to make sure that the comments we receive are not gibberish. But we can do that simply by reading the comments and deleting any that don't make sense. So, I think, we can assume that we've done enough checking. What we need to do now is clean up our form. When we do this, we might as well universalize our form and make the php section work on any type of form. Should we make another form, we can use the same php checks. If you decide to make a form with ten or a hundred inputs you can use the same php checks. To do this, we go back to our form's email "spam eregi" check. Use the find and replace key to replace "$email" with "$value." Do the same for the "unnecessary character" eregi check. When you submit a form, all of the form inputs are saved in a two-dementional array. Each input has a name (or $key) and a value ($value). The name (or $key) is whatever you decide to name your input - be it "firstname" or "email". The value is what the person filling out your form enters for a certain input like "Mary" or "buddy@aol.net". In the case of the form used here, all inputs are saved in a "$_POST" array. So now we will list the elements in this array and check to make sure that this array exists. Then we will adjust the above eregi checks to begin to simplify and universalize our form. The code for this is as follows:

if (is_array($_POST)) {
while (list($key, $value) = each($_POST)) {
echo htmlspecialchars("$key: $value") . ' ';
echo 'The number of characters in ' . $key . ' is ' . strlen($value) . '. ';
if (eregi("MIME-Version:",$value) || eregi("multipart/",$value) || eregi("\n",$value) || eregi("{",$value) || eregi("\r",$value) || eregi("}",$email) || eregi("<",$value) || eregi(">",$value) || eregi("\|",$value) || eregi("%0a",$value) || eregi("%0d",$value) || eregi("bcc:",$value) || eregi("cc:",$value) || eregi("to:",$value) || eregi("content-type:",$value) )
{
die("Please double check your $key. To prevent someone from spamming from the $key section of this form, certain special characters and phrases trigger this form to shut down. The special characters and phrases appear after the following equal sign. If nothing suspicious shows immediately after the equal sign, the missing characters are in machine language or are coded characters - characters like the greater than symbol (>), the less than symbol (<), info enclosed within these symbols ... Invalid additional input = $value. Missing characters may include <?php, <body>, </html>,etc.");
}
if (eregi("\|",$value) || eregi("\[",$value) || eregi("\]",$value) || eregi("\~",$value) || eregi("\`",$value) || eregi("\^",$value) || eregi("\*",$value) || eregi("&",$value) || eregi("\+",$value) || eregi("=",$value) || eregi("#",$value) )
{
$keyone = "1";
die('Please find another way of entering your ' . $key . '. Certain standard keyboard characters are not needed to fill out the ' . $key . ' section of this form.
These unnecessary characters trigger this form to shut down to prevent their use in viruses, spam injections or other malware.
You are reading this message because you have used one, or more, of these characters. The list of
unnecessary characters are as follows: the pipe symbol (|), rectangular parenthesis ([]), the asterisk (*), the ampersand (&), the plus sign (+), the equal sign (=), the number or pound sign (#) and various other characters like ~, `, ^.
If you wish to complete this form, please hit the "back" button on your browser.
This will return you to your form.
Then, if possible, edit your ' . $key . ' so that it is composed of alphabetic characters and non-alphabetic characters other than those listed above. Thankyou. And ' . $key . 'one = ' . ($keyone) . '.');
}
}

}

Replacing the old code with this will result in a form which looks like this (click here) and acts like this (click here). And with a little modification, we can get our form to act like this (click here). Notice any difference in how this new form acts?

Using message[] instead of echo

Using 'HTTP_POST_VAR'

Cleaning comments when input is O.K.

For more, continue on the next page
- on page 8

Flying Into Formation - Part II - pages . . .

1 . . .

2 . . .

3 . . .

4 . . .

5 . . .

6 . . .

7 . . .

Your IP address is: 38.103.63.59

Lorem ipsum dolor sit amet, consetetur sadipscing elitr, sed diam nonumy eirmod tempor invidunt ut labore et dolore magna aliquyam erat, sed diam voluptua. Lorem ipsum dolor sit amet, consetetur sadipscing elitr, sed diam nonumy eirmod tempor invidunt ut labore et dolore magna aliquyam erat, sed diam voluptua. Lorem ipsum dolor sit amet, consetetur sadipscing elitr, sed diam nonumy eirmod tempor invidunt ut labore et dolore magna aliquyam erat, sed diam voluptua. Lorem ipsum dolor sit amet, consetetur sadipscing elitr, sed diam nonumy eirmod tempor invidunt ut labore et dolore magna aliquyam erat, sed diam voluptua.