Back to DFS's Workshop Page
Back to Agenda Page

Setting Defaults for Incoming Data

In order to protect a script, it is important to check data coming from the outside.

We will use a simple program which receives the number of times a loop is to execute for this demonstration.

Bulletproofing a PHP Script for Incoming Data

The following code should be saved in a file called defaultloop.php in ~YOURID/public_html/test_php/.

<!-- defaultloop.php -->
<html>
<head>
<title>Establishing a default value</title>
</head>
<body>
<?php
// This script illustrates how to check information
// which could be passed from another script

if ( empty($num) ) {
   echo "<p>Zero or null received, using a default of 5...</p>\n";
   $num = 5;
}
else if ($num < 0) {
   die ("<p>Negative number ($num) received, exiting...</p>\n");
}
for ($i = 1; $i <= $num; $i++)
   echo "<p>" . $i . "</p>\n";
?>
</body>
</html>

Notes

The function empty returns TRUE if no value or zero has been assigned to the variable being checked.
Checking variables in this way is important so that hackers have a more difficult time breaking into your web site.
It is also possible to check your scripts by simply changing the variable specifications in the URL, e.g., http://localhost/~YOURID/test_php/defaultloop.php?num=10.