Verifying fields in the API Classess

[VBCoder]

Taking a look through the API, I see that when set()ing, you can choose whether to verify or not.

Two questions:
1) How does vB verify? I can't find the code to do it. I see all these references to VF_METHOD, but can't figure out what that is.

2) If you don't verify, and put in bad data, what happens? Does vB try to roll with it, and do as much as it can? Does it crash? Or, does it corrupt the database?

[VBCoder]

As I haven't gotten a response, I'm assuming that my post lacked enough details to be clear. Please let me know what other information I need to add.

[Andreas]

Originally Posted by class_dm.php

FIELD 2 (VF_CODE) - This contains code to be executed as a lamda function called as 'function($data, $this)'.
Alternatively, the value can be VF_METHOD, in which case, $this->verify_{$fieldname} will be called.

In other words:
If this is set to VF_METHOD, a function verfiy_fieldname will be used to verify this field - or the function specified (FIELD 3, VF_METHODNAME).

If you don't verify, the data may be garbage (for examle 'c:\winnt' set as email in User Datamanager).

[VBCoder]

Thanks, Kirbs - you hit the nail on the head.

If you don't verify, the data may be garbage (for examle 'c:\winnt' set as email in User Datamanager).

Is there any prediction what happens in these cases (will the error be caught before corrupting the whole forum db?)?

[Andreas]

I think if there are no further checks in presave(), the data will just be written to the database.
At least this is how the User Datamanager behaves (with c:\winnt as eMail).

This might cause inconsistent data.
However, it should not cause mySQL-Errors.
But if you also set clean to false, the datatype will not be checked - and you might run into mySQL Errors and SQL injection vulnerbilities.