In validating alpha for the purpose of accepting a name, you might want to permit the ' character, as in O'Leary. And while you're at it, don't forget the possibility of someone having an accent of some form over one of the vowel's in their name. `'^~, etc. Ferdnand Magellen's name, in Portuguese is Fernando Magalhae~s (but with the tilde over the 'e').

Your date format is somewhat limiting. It requires that the date come in with one particular (Americanized) format. While you'll still need to properly check it for taintedness, it might be helpful for your HTML to also help the user to get it right by providing drop-downs for the date instead of freehand input. Date::Manip may help you to be able to accept a broader range of date formats.

Your phone validation is ok for the 50 states. It breaks down for international numbers, or local numbers for other countries.

Your email validation is errant. You can't validate an email address with a regexp. You can't even guarantee that it is syntactically sound, without inadvertantly rejecting some syntactically correct addresses. Sorry. Friedl has an example that does a pretty good job at the end of his book, Mastering Regular Expressions (the Owls book). But he even goes on to explain in that book that his example isn't 100% reliable. For email, I think one of the best approaches is to carefully keep that address away from the shell, and in a safe way, send a verification email to the address in question, requesting a reply with a particular hard-to-guess code in it.

PS: You're getting onto the right track. Do realize however that there is a difference between validating and untainting. If you can keep an email address away from the shell, and you can validate it through an actual email exchange with the user, you're most of the way there.


Dave


"If I had my life to live over again, I'd be a plumber." -- Albert Einstein

In reply to Re: Am I passing and testing user data correctly? by davido
in thread Am I passing and testing user data correctly? by bradcathey

Title:
Use:  <p> text here (a paragraph) </p>
and:  <code> code here </code>
to format your post, it's "PerlMonks-approved HTML":


  • Posts are HTML formatted. Put <p> </p> tags around your paragraphs. Put <code> </code> tags around your code and data!
  • Titles consisting of a single word are discouraged, and in most cases are disallowed outright.
  • Read Where should I post X? if you're not absolutely sure you're posting in the right place.
  • Please read these before you post! —
  • Posts may use any of the Perl Monks Approved HTML tags:
    a, abbr, b, big, blockquote, br, caption, center, col, colgroup, dd, del, details, div, dl, dt, em, font, h1, h2, h3, h4, h5, h6, hr, i, ins, li, ol, p, pre, readmore, small, span, spoiler, strike, strong, sub, summary, sup, table, tbody, td, tfoot, th, thead, tr, tt, u, ul, wbr
  • You may need to use entities for some characters, as follows. (Exception: Within code tags, you can put the characters literally.)
            For:     Use:
    & &amp;
    < &lt;
    > &gt;
    [ &#91;
    ] &#93;
  • Link using PerlMonks shortcuts! What shortcuts can I use for linking?
  • See Writeup Formatting Tips and other pages linked from there for more info.