Chovy's Blog

The below is written in Perl, but is simple enough to adapt to any web programming language.

Our simple form has two fields. Lets say a phone number as an optional field, and another required field for first name.

For simplicity, I’ll assume a first name can contain spaces and uppercase or lowercase letters, and a phone number can contain parenthesis, hyphens, spaces, and digits.

We will assume your application framework already has a mechanism in place to create or update an application user (Application::User), and a means of notifying the user interface (UI::Message) with the appropriate methods and constructors.

my $user = new Application::User;
my $msg = new UI::Message;
my $first_name = $ARGS{'first_name'};
my $phone_number = $ARGS{'phone_number'};

#required field first name must always be present.
unless ( $first_name && $first_name =~ m/^[a-zA-Z ]+$/ ) {
   $msg->err('first_name', "First name is a required field and can only contain upper and lowercase letters with spaces.");
}

#validate phone number if we have data for this field (optional)
if ( $phone_number && $phone_number !~ m/^[0-9\-\(\) ]+$/ ) {
   $msg->err( 'phone_number, "Phone number should be in the form: (555) 555-5555." ).
}

#stop if we encountered errors
return if $msg->has_errors;

#continue saving the data if we get this far because we have a valid First Name and valid Phone Number

$user->set( 'phone_number', $phone_number ) if $phone_number;
$user->set( 'first_name', $first_name );

if ( $user->save() ) {
    $msg->ok("You have successfully updated your contact details.");
}

Its an important security practice to “white list” all acceptable values prior to saving data or handling it within a web application.

Perl regular expression are a good way to validate strings of values. Simple regexes should always be tied to the beginning and end of the variable in question, otherwise you’re only matching against a substring.

For example:

$phone_number =~ m/\d+/; #matches at least one digit (but could contain any number of nefarious characters)

Better example:

$phone_number =~ m/^\d+$/; #tied to beginning "^" and end "$" of the string

…ONLY digits are allowed with this rule.