Typing user input
Every input arrives as a string: explicit conversion to the expected type, strict comparison, allowlist of values, rejection rather than repair, and the pitfalls of loose comparison.
- 23 cards
- 4 topics
- Free
The outline, topic by topic
Each topic is weighted the way the exam weighs it.
- Concepts
- Questions
- Sort and link
- Scenarios
A few cards from the deck
Input validation: what is it?
Show the answer
A server-side check that a received value has the expected form and type before it is used.
Everything arriving from the client can be altered: the browser check improves entry, but only the server's check protects. An invalid value is rejected, not silently repaired.
In PHP 8, what does the following expression evaluate to?
```php
var_dump("10" == "1e1");`- bool(true)
- bool(false)
- int(10)
- Warning: A non-numeric value
Show the answer
bool(true)
When both operands are numeric strings, == compares them as numbers: 10 and 1e1 (that is 10) are equal. With ===, the result is false, since the strings differ.
In HTTP, every form or URL value reaches the server as a character …, even when it represents a number.
Show the answer
In HTTP, every form or URL value reaches the server as a character string, even when it represents a number.
$_GET['page'] is the string '3', not the integer 3. The program must convert and check it itself before using it.
Implicit coercion: what is it?
Show the answer
A type change done automatically by the language to compare or combine two values of different types.
It gives surprising results: in PHP 8, '10' == '1e1' is true because both strings are read as numbers. A strict operator (===) never converts.
The page liste.php?page=abc crashes the SQL query that computes the offset (page - 1) * 20. What is the cause and the fix?
- The database is too slow: add an index on the column sorted by the SQL query
- The browser sends the parameter badly: switch GET to POST in the form
- The input is never converted: validate it as a bounded integer, otherwise answer 400
- The server lacks memory: raise PHP's memory limit in the configuration
Show the answer
The input is never converted: validate it as a bounded integer, otherwise answer 400
The string 'abc' gets computed as a number or pasted into the query unchecked. Convert to an integer, bound it (at least 1, at most the page count) and, if impossible, refuse with a 400 rather than guessing.