ok just a tutorial for newbies ive been asked this question many times this is the answer
Form validation is required to prevent web form abuse by malicious users . Improper validation of form data is one of the main causes of security vulnerabilities . It exposes your website to attacks such as header injections , cross-site scripting , and SQL injections .
header injection attacks can be used to send email spam from your web server
cross-site scripting may allow an attacker to post any data to your site
SQL injection may corrupt your database backend
A mandatory practice is to always implement client / server-side validation techniques on all input fields of submitted content by the user . This article will focus on validating the email-address field , I used to use eregi for validating email address input that matches to the regular expression . That would return true if given email address is matches to username@domain.com pattern. Unfortunately, after upgrading PHP to the earlier version (5.3.0), it wont work properly . This is because eregi is one of several functions that are deprecated in the new version of PHP . Solution : Use preg_match with the ‘i’ modifier instead. i means that regular expression is case insensitive . So the code become like this :
List of depreciated functions in PHP 5.3.x :
call_user_method() (use call_user_func() instead)
call_user_method_array() (use call_user_func_array() instead)
define_syslog_variables()
dl()
ereg() (use preg_match() instead)
ereg_replace() (use preg_replace() instead)
eregi() (use preg_match() with the ‘i’ modifier instead)
eregi_replace() (use preg_replace() with the ‘i’ modifier instead)
set_magic_quotes_runtime() and its alias, magic_quotes_runtime()
session_register() (use the $_SESSION superglobal instead)
session_unregister() (use the $_SESSION superglobal instead)
session_is_registered() (use the $_SESSION superglobal instead)
set_socket_blocking() (use stream_set_blocking() instead)
split() (use preg_split() instead)
spliti() (use preg_split() with the ‘i’ modifier instead)
sql_regcase()
mysql_db_query() (use mysql_select_db() and mysql_query() instead)
mysql_escape_string() (use mysql_real_escape_string() instead)
Passing locale category names as strings is now deprecated. Use the LC_* family of constants instead.
The is_dst parameter to mktime(). Use the new timezone handling functions instead.
--------------------------------------------------------------------------------------
I hope this information will help the newbies getting this type of error.
Form validation is required to prevent web form abuse by malicious users . Improper validation of form data is one of the main causes of security vulnerabilities . It exposes your website to attacks such as header injections , cross-site scripting , and SQL injections .
header injection attacks can be used to send email spam from your web server
cross-site scripting may allow an attacker to post any data to your site
SQL injection may corrupt your database backend
A mandatory practice is to always implement client / server-side validation techniques on all input fields of submitted content by the user . This article will focus on validating the email-address field , I used to use eregi for validating email address input that matches to the regular expression . That would return true if given email address is matches to username@domain.com pattern. Unfortunately, after upgrading PHP to the earlier version (5.3.0), it wont work properly . This is because eregi is one of several functions that are deprecated in the new version of PHP . Solution : Use preg_match with the ‘i’ modifier instead. i means that regular expression is case insensitive . So the code become like this :
PHP Code:
01 function validate_email($email)
02 {
03
04 /* deprecated */
05 if(eregi("^[_\.0-9a-zA-Z-]+@([0-9a-zA-Z][0-9a-zA-Z-]+\.)+[a-zA-Z]{2,6}$", $email)) {
06 return "email is valid ";
07 } else {
08 return "email is not valid " ;
09 }
10
11 /* Solution */
12 if(preg_match("/^[_\.0-9a-zA-Z-]+@([0-9a-zA-Z][0-9a-zA-Z-]+\.)+[a-zA-Z]{2,6}$/i", $email)) {
13 return "email is valid ";
14 } else {
15 return "email is not valid " ;
16 }
17 }
18 echo validate_email('your.domain@gmail.com'); //returns "email is valid"
19 echo validate_email("your.domain@.com") ; //returns "email in not valid"
call_user_method() (use call_user_func() instead)
call_user_method_array() (use call_user_func_array() instead)
define_syslog_variables()
dl()
ereg() (use preg_match() instead)
ereg_replace() (use preg_replace() instead)
eregi() (use preg_match() with the ‘i’ modifier instead)
eregi_replace() (use preg_replace() with the ‘i’ modifier instead)
set_magic_quotes_runtime() and its alias, magic_quotes_runtime()
session_register() (use the $_SESSION superglobal instead)
session_unregister() (use the $_SESSION superglobal instead)
session_is_registered() (use the $_SESSION superglobal instead)
set_socket_blocking() (use stream_set_blocking() instead)
split() (use preg_split() instead)
spliti() (use preg_split() with the ‘i’ modifier instead)
sql_regcase()
mysql_db_query() (use mysql_select_db() and mysql_query() instead)
mysql_escape_string() (use mysql_real_escape_string() instead)
Passing locale category names as strings is now deprecated. Use the LC_* family of constants instead.
The is_dst parameter to mktime(). Use the new timezone handling functions instead.
--------------------------------------------------------------------------------------
I hope this information will help the newbies getting this type of error.
Comment