clean_array_gpc question

[SkyStryder]

I have a URL that looks like this:

beta.test.com/vb/runlib.php?do=cars&model=cobalt&fsec=6,13,19,30&fo r=federal%20express

I am concerned with checking the fsec variable. If I use TYPE_INT, it truncates
all but the first number. If I use TYPE_STR, that doesn't really help. Could someone
point me in the right direction?

Thank you!

[kh99]

How do you want to check it? You can use TYPE_STR then do your own checking. I assume you want to check to avoid vulnerabilities? Then it depends on how you intend to use the value.

[mokujin]

What about TYPE_UNIT ?

[Dave]

Set as string and you could do something like this:

PHP Code:

$fsec = '56,56,56';
$num = explode(",", $fsec);
foreach($num as $key=>$val){
  if(!ctype_digit($val)){
    unset($num[$key]);
  }
}
$fsec = implode(",", $num); 


[SkyStryder]

Thank you, This looks doable.
In answer to the others, this is pretty much what I would need to do if I used
TYPE_NOHTML (TYPE_STR). TYPE_UINT also returns just the first number.

Thank you all!

[Dave]

You indeed want to use TYPE_NOHTML unless you actually make use of HTML in certain strings.

[TheAdminMarket]

Try TYPE_ARRAY_INT (for numbers) or TYPE_ARRAY_STR (for strings)

EDIT: Try the article below. Is superior and it helped me a lot to start coding for vB
https://vborg.vbsupport.ru/showthrea...ight=Variables

[SkyStryder]

I tried TYPE_ARRAY_INT and it would appear that I got an empty array as a result...
I used fsec=51,71,68,88,93,90 from the URL. I tried print_r and var_dump and they
seem to confirm the results. It definitely wasn't a string anymore. explode croaked... 8-)

--------------- Added [DATE]1412704140[/DATE] at [TIME]1412704140[/TIME] ---------------

I thing that I have noticed is that isset() is not working as expected with $vbulletin->GPC['xx']
It seems to resolve to always true which is not what it says in class_core.php.

[TheAdminMarket]

Originally Posted by SkyStryder

I tried TYPE_ARRAY_INT and it would appear that I got an empty array as a result...

I've used this code so many times and works fine, but I'm currently out of my base to post a real example. Even if TYPE_ARRAY_... is more secure as it add one more level of security on what type of data to receive, you can also use TYPE_ARRAY without setting if it's number or text string.

--------------- Added 07 Oct 2014 at 21:44 ---------------

Also, because as I seen you're collecting the values from URL, you must use the syntax:

PHP Code:

$vbulletin->input->clean_array_gpc('r', array(
   'fsec' => TYPE_ARRAY_INT
)); 


r = Request
p = Post
g = Get

[SkyStryder]

[QUOTE=NickTheGreek;2518036]
Also, because as I seen you're collecting the values from URL, you must use the syntax:

PHP Code:

$vbulletin->input->clean_array_gpc('r', array(
   'fsec' => TYPE_ARRAY_INT
)); 


That is exactly what I have and I get an empty array. Not to be too obvious
but fsec looks like a string.. "1,2,4" I was getting the impression that
TYPE_ARRAY_INT would do the conversion? It definitely sets the type.