Hi All

I have wrote a script that is accepting input from a form that people fill out on my website. I am running with Taint, and not sure if i even need to go to all of this trouble to validate people's input and scan it for nasties. It all looks very messy. Here is a snippet:

if ($fullname !~ /^[-.\w\s]{2,20}$/) {
        $message = $message.'<p>Please Enter Your Full Name Between 2-
+20 Characters With No Symbols.</p>';
        $found_err = 1; }

if ($username !~ /^[a-z][a-z0-9-._]{1,15}$/) {
        $message = $message.'<p>Please Enter Your Desired Username In 
+Lower Case Only With No Symbols And Between 2-16 Characters.</p>';
        $found_err = 1; }

if ($username =~ m/^admin|administrator|accounts|support|postmaster|we
+bmaster|
        |technical|billing|sales|purchase|buy|misuse|assistance|mail$/
+) {
        $message = $message.'<p>Sorry, The Chosen Username Is Containe
+d Within Our Dictionary. Please Choose Another Username.</p>';
        $found_err = 1; }

if ($password !~ /^[a-zA-Z0-9-._]{5,29}$/) {
        $message = $message.'<p>Please Enter A Password Between 6-30 C
+haracters With No Symbols. This Can Be Changed Later.</p>';
        $found_err = 1; }

if ($mothers !~ /^[-.\w\s]{2,20}$/) {
        $message = $message.'<p>Please Enter Your Mothers Maiden Name 
+Between 2-20 Characters With No Symbols.</p>';
        $found_err = 1; }

if ($email !~ /^([a-zA-Z0-9_\.\-])+\@(([a-zA-Z0-9\-])+\.)+([a-zA-Z0-9]
+)+$/i) {
    $message = $message.'<p>Please Enter A Valid E-Mail Address. Your 
+User Information Will Be Sent Here.</p>';
    $found_err = 1; }

if ($referral !~ /^[-.\w\s]{3,60}$/) {
        $message = $message.'<p>Please Enter Where You Heard About XXX
+. This Must Be Between 3-60 Characters Long With No Symbols.</p>';
        $found_err = 1; }

if ($conditions !~ m/^Yes$/) {
        $message = $message.'<p>Please Accept The Terms And Conditions
+ To Register.</p>';
        $found_err = 1; }

if ($quota !~ m/^0|2|4|6|8|10|12|14|16|18|20|30|40|50|60|70|80|90|100$
+/) {
        $message = $message.'<p>Your Chosen Mailbox Quota Does Not App
+ear To Be A Valid Option. Contact Support For Assistance.</p>';
        $found_err = 1; }

if ($spam !~ m/^10|0$/) {
        $message = $message.'<p>Your Chosen Spam Filtering Option Does
+ Not Appear To Be Vaild. Contact Support For Assistance.</p>';
        $found_err = 1; }

if ($antivirus !~ m/^10|0$/) {
        $message = $message.'<p>Your Chosen Virus Filtering Option Doe
+s Not Appear To Be Vaild. Contact Support For Assistance.</p>';
        $found_err = 1; }

if ($bandwidth !~ m/^15|0$/) {
        $message = $message.'<p>Your Chosen Bandwidth Option Does Not 
+Appear To Be Vaild. Contact Support For Assistance.</p>';
        $found_err = 1; }

if ($support !~ m/^2|0$/) {
        $message = $message.'<p>Your Chosen Support Option Does Not Ap
+pear To Be Vaild. Contact Support For Assistance.</p>';
        $found_err = 1; }

if ($found_err) {
    &PrintError; }


sub PrintError { 
print "Content-type: text/html\n\n";
print $message;
exit 0;
return 1; 
}
[download]

edited: Fri May 2 16:16:19 2003 by jeffa - title change (was: There MUST be a better way to validate?)

---

---

Posts are HTML formatted. Put <p> </p> tags around your paragraphs. Put <code> </code> tags around your code and data!

Titles consisting of a single word are discouraged, and in most cases are disallowed outright.

Read Where should I post X? if you're not absolutely sure you're posting in the right place.

Please read these before you post! —

• How do I compose an effective node title?
• How do I post a question effectively?
• Markup in the Monastery

Posts may use any of the Perl Monks Approved HTML tags:

a, abbr, b, big, blockquote, br, caption, center, col, colgroup, dd, del, details, div, dl, dt, em, font, h1, h2, h3, h4, h5, h6, hr, i, ins, li, ol, p, pre, readmore, small, span, spoiler, strike, strong, sub, summary, sup, table, tbody, td, tfoot, th, thead, tr, tt, u, ul, wbr

You may need to use entities for some characters, as follows. (Exception: Within code tags, you can put the characters literally.)

	For:		Use:
	&		&
	<		&lt;
	>		&gt;
	[		&#91;
	]		&#93;

Link using PerlMonks shortcuts! What shortcuts can I use for linking?

See Writeup Formatting Tips and other pages linked from there for more info.