I am having some issues with a website that I have created. I used zend_form
with an ini file and the zend_db.
I have validation on the registration form for this website to limit input
characters to a set pattern i.e.
interested.elements.email.options.validators.regex.options.pattern =
"/^[a-za-z...@+^_,-.!#$%&*+=? ]*$/"
My code to take the data and put it into the database is:
if ($this->_request->isPost())
{
$formData = $this->_request->getPost();
if ($form->isValid($formData))
{
$GLOBALS['db']->insert('users',array(
'Title' => $formData['title'],
'Firstname' => $formData['firstname'],
'Lastname' => $formData['surname'],
'Position' => $formData['position'],
'Affiliation' => $formData['affiliation'],
'Discipline' => $formData['discipline'],
'Address' => $formData['address1st'],
'Address2' => $formData['address2nd'],
'City' => $formData['addresscity'],
'Country' => $formData['addresscountry'],
'Postcode' => $formData['postcode'],
'Telephoneno' => $formData['telephone'],
'Email' => $formData['email'],
'Reason' => $formData['why'])
);
Now we are running into problems where individuals in countries such as
Sweeden have special characters in the data (i.e. stråket). I know the
documentation states that :
"By default, the values in your data array are inserted using parameters.
This reduces risk of some types of security issues. You don't need to apply
escaping or quoting to values in the data array. "
Am I correct in thinking that this means that any attempt to embed a query
(an sql injection) into the form wouldn't work? In the same way that
mysql_escape_string function works? Do I really need then to regular
expression the input on the form? Or should I be concerning myself about
other possible issues ? Such as XSS?
--
View this message in context:
http://www.nabble.com/Foreign-Characters-tp21497453p21497453.html
Sent from the Zend Framework mailing list archive at Nabble.com.
