Re: PHP variable sanitization functions

["Tim Tompkins" <lists () spiderlinks org>]

> function check_numeric($numeric, $extras='') {
> if (!is_numeric($numeric)) {
> $this->set_error("Type not numeric");
> return FALSE;
> }
>
> // convert it to int for checking
> $numeric_val = (int)$numeric;
>
> return ($this->check_integer($numeric_val, $extras));
> }


Note that "numeric" != "integer".  Numeric also includes real numbers
(floats), so your cast to int could alter the intentions of the caller if
$extras contains fractional "minimum" and/or "maximum" values.  Imagine a
form testing input through check_numeric() with a value of 12.5 to be in the
range of 12.25 to 12.75.  12.5 would pass is_numeric(), but would fail once
passed through check_integer.  Actually, since check_integer() also expects
"minimum" and "maximum" to also be integers, testing a float range would
return a false positive because "minimum" and/or "maximum" would not test
out to integers, so the range tests would never be applied.  So
check_numeric() with a value of 1 and a range of 10.0 to 20.0 would test
true.


--
Tim Tompkins