Hello all,

I wrote the sub below to check for user input. It's a rather restrictive check as only alphanumeric characters and a small set of non-word characters are allowed. It also checks for obligatory fields, minimum and maximum characters permitted and whether an input should be numeric.

I'm seeking your opinion on whether the coding practice I adopt is a sound one and if not, how should I change it. It works with limited testing. Please feel free to comment on my code.

# The meaning of each argument
# ($data, $field, $obligatory, $min, $max, $numeric) 

# Username is obligatory, must be at least 2 character long
# and must not be more than 30 characters (note that the
# numeric is undef so a username can be numbers.
my $username = sanitize(param('username'), 'Username', 1, 2, 30);

# Level must be a single character and must be numeric
my $level = sanitize(param('level'), 'Level', 1, 1, 1, 1);

sub sanitize {
  # $data may contain evil characters
  my ($data, $field, $obligatory, $min, $max, $numeric) = @_;
  $data =~ s/\s+/ /g;
  # Remove extra spaces to nothing
  $data =~ s/  +//g;
  # remove leading and trailing blanks
  $data =~ s/^\s+//;
  $data =~ s/\s+$//;
  # If data contains something
  if ($data) {
    if ($data =~ /^([-\@\w. ]+)$/) {
      # Check length
      my $length = length($data);
      if ($min || $max) {
        if ($min == $max) {
          bail_out("Data does not meet the required length.") if ($len
+gth != $min);
        }
        if ($min && $length < $min) {
          bail_out("Too short.")
        }
        if ($max && $length > $max) {
          bail_out("Too long.")
        }
      }
      if ($numeric) {
        bail_out("Data must be numeric.") if ($data !~ /^\d*$/);
      }
      return $data;        
    }
    else {
      bail_out("Bad data.");
    }
  }
  # If data is an empty string
  else {
    if ($obligatory) {
      bail_out("Data at $field is empty.");
    }
    else {
      return undef;
    }
  }
}
[download]

---

---

Posts are HTML formatted. Put <p> </p> tags around your paragraphs. Put <code> </code> tags around your code and data!

Titles consisting of a single word are discouraged, and in most cases are disallowed outright.

Read Where should I post X? if you're not absolutely sure you're posting in the right place.

Please read these before you post! —

• How do I compose an effective node title?
• How do I post a question effectively?
• Markup in the Monastery

Posts may use any of the Perl Monks Approved HTML tags:

a, abbr, b, big, blockquote, br, caption, center, col, colgroup, dd, del, details, div, dl, dt, em, font, h1, h2, h3, h4, h5, h6, hr, i, ins, li, ol, p, pre, readmore, small, span, spoiler, strike, strong, sub, summary, sup, table, tbody, td, tfoot, th, thead, tr, tt, u, ul, wbr

You may need to use entities for some characters, as follows. (Exception: Within code tags, you can put the characters literally.)

	For:		Use:
	&		&
	<		&lt;
	>		&gt;
	[		&#91;
	]		&#93;

Link using PerlMonks shortcuts! What shortcuts can I use for linking?

See Writeup Formatting Tips and other pages linked from there for more info.