vb.org Archive - clean_array

vb.org Archive (https://vborg.vbsupport.ru/index.php)

- vB4 Programming Discussions (https://vborg.vbsupport.ru/forumdisplay.php?f=252)

- - clean_array_gpc question (https://vborg.vbsupport.ru/showthread.php?t=314756)

SkyStryder

10-07-2014 02:25 PM

clean_array_gpc question

I have a URL that looks like this:

Quote:

beta.test.com/vb/runlib.php?do=cars&model=cobalt&fsec=6,13,19,30&fo r=federal%20express

I am concerned with checking the fsec variable. If I use TYPE_INT, it truncates
all but the first number. If I use TYPE_STR, that doesn't really help. Could someone
point me in the right direction?

Thank you!

kh99	10-07-2014 02:27 PM

How do you want to check it? You can use TYPE_STR then do your own checking. I assume you want to check to avoid vulnerabilities? Then it depends on how you intend to use the value.

mokujin

10-07-2014 02:27 PM

What about TYPE_UNIT ?

Dave	10-07-2014 02:44 PM

Set as string and you could do something like this:

PHP Code:


		
			
$fsec = '56,56,56';
$num = explode(",", $fsec);
foreach($num as $key=>$val){
  if(!ctype_digit($val)){
    unset($num[$key]);
  }
}
$fsec = implode(",", $num);

SkyStryder

10-07-2014 02:55 PM

Thank you, This looks doable.
In answer to the others, this is pretty much what I would need to do if I used
TYPE_NOHTML (TYPE_STR). TYPE_UINT also returns just the first number.

Thank you all!

Dave	10-07-2014 03:02 PM

You indeed want to use TYPE_NOHTML unless you actually make use of HTML in certain strings.

TheAdminMarket

10-07-2014 03:40 PM

Try TYPE_ARRAY_INT (for numbers) or TYPE_ARRAY_STR (for strings)

EDIT: Try the article below. Is superior and it helped me a lot to start coding for vB
https://vborg.vbsupport.ru/showthrea...ight=Variables

SkyStryder

10-07-2014 04:11 PM

I tried TYPE_ARRAY_INT and it would appear that I got an empty array as a result...
I used fsec=51,71,68,88,93,90 from the URL. I tried print_r and var_dump and they
seem to confirm the results. It definitely wasn't a string anymore. explode croaked... 8-)

--------------- Added [DATE]1412704140[/DATE] at [TIME]1412704140[/TIME] ---------------

I thing that I have noticed is that isset() is not working as expected with $vbulletin->GPC['xx']
It seems to resolve to always true which is not what it says in class_core.php.

TheAdminMarket

10-07-2014 05:23 PM

Quote:

Originally Posted by SkyStryder (Post 2518028)

I tried TYPE_ARRAY_INT and it would appear that I got an empty array as a result...

I've used this code so many times and works fine, but I'm currently out of my base to post a real example. Even if TYPE_ARRAY_... is more secure as it add one more level of security on what type of data to receive, you can also use TYPE_ARRAY without setting if it's number or text string.

--------------- Added 07 Oct 2014 at 21:44 ---------------

Also, because as I seen you're collecting the values from URL, you must use the syntax:

PHP Code:


		
			
$vbulletin->input->clean_array_gpc('r', array(
   'fsec' => TYPE_ARRAY_INT
));

r = Request
p = Post
g = Get

SkyStryder

10-07-2014 06:24 PM

[QUOTE=NickTheGreek;2518036]
Also, because as I seen you're collecting the values from URL, you must use the syntax:

PHP Code:


		
			
$vbulletin->input->clean_array_gpc('r', array(

   'fsec' => TYPE_ARRAY_INT

));

That is exactly what I have and I get an empty array. Not to be too obvious
but fsec looks like a string.. "1,2,4" I was getting the impression that
TYPE_ARRAY_INT would do the conversion? It definitely sets the type.

TheAdminMarket

10-07-2014 06:47 PM

Quote:

Originally Posted by SkyStryder (Post 2518012)

If I use TYPE_STR, that doesn't really help.

Why are you saying it? The code below works fine:

PHP Code:


		
			
// ##### REQUIRE BACK-END #####

require_once('./global.php');

// ##### TESTING ARRAY REQUEST #####

if ($_REQUEST['do'] == 'testarray')

{

    $fsec = $vbulletin->input->clean_gpc('r', 'fsec', TYPE_STR);

    $fsec_data = explode(',', $fsec);

    print_r($fsec_data);

}

You can check it:
http://www.christeris.net/vb422/test...sec=6,13,19,30

--------------- Added [DATE]1412711489[/DATE] at [TIME]1412711489[/TIME] ---------------

Quote:

Originally Posted by SkyStryder (Post 2518051)

Not to be too obvious
but fsec looks like a string.. "1,2,4" I was getting the impression that
TYPE_ARRAY_INT would do the conversion? It definitely sets the type.

TYPE_ARRAY_INT should never works as you're sending the data as string and not as Array. Further more I don't even know if you can send Array in a URL. But as form element you can do, and guarantee that TYPE_ARRAY_INT and TYPE_ARRAY_STR works. But as form element.

SkyStryder

10-07-2014 06:58 PM

yes, I do realize that and that method works. I was further interested
in if TYPE_ARRAY_INT would work... However, looking at the class,
TYPE_ARRAY_INT is defined as '102' but never used as far as I can tell.

TheAdminMarket

10-07-2014 07:01 PM

Quote:

Originally Posted by SkyStryder (Post 2518058)

We can continue with more tests tomorrow. It's 23:00pm for me, and my bed is calling me :)

SkyStryder

10-07-2014 07:11 PM

Thank you for the help!

All times are GMT. The time now is 08:04 PM.

X vBulletin 3.8.12 by vBS Debug Information
Page Generation 0.01134 seconds Memory Usage 1,761KB Queries Executed 10 (?)
More Information
Template Usage: (1)ad_footer_end (1)ad_footer_start (1)ad_header_end (1)ad_header_logo (1)ad_navbar_below (4)bbcode_php_printable (5)bbcode_quote_printable (1)footer (1)gobutton (1)header (1)headinclude (6)option (1)post_thanks_navbar_search (1)printthread (14)printthreadbit (1)spacer_close (1)spacer_open Phrase Groups Available: global postbit showthread	Included Files: ./printthread.php ./global.php ./includes/init.php ./includes/class_core.php ./includes/config.php ./includes/functions.php ./includes/class_hook.php ./includes/modsystem_functions.php ./includes/class_bbcode_alt.php ./includes/class_bbcode.php ./includes/functions_bigthree.php Hooks Called: init_startup init_startup_session_setup_start init_startup_session_setup_complete cache_permissions fetch_threadinfo_query fetch_threadinfo fetch_foruminfo style_fetch cache_templates global_start parse_templates global_setup_complete printthread_start bbcode_fetch_tags bbcode_create bbcode_parse_start bbcode_parse_complete_precache bbcode_parse_complete printthread_post printthread_complete
Messages: