Phalcon形式消毒

Question

Is there a way in which one can filter data that is auto-completed in a form generated by VOLT. Consider the login form: Email/password. When I edit the HTML (in the broser) and send the email as an array ('name="email[]") I can sanitize it in PHP and 'cast' as en email:

            $loginEmail = $this->request->getPost("email",'string');
            $loginEmail = $this->filter->sanitize($loginEmail, "email");

in order to prevent other attacks. But when making the email field an array VOLT generates an error:

"Notice: Array to string conversion in ..."

VOLT form values are populated automatically...

I know I should disable NOTICES in production but still...

How can I treat this by using VOLT?

EDIT Template sample:

{{ text_field('id':"email","class":"form-control", "size": 32,"placeholder":'Email address') }}

After a var_dump and setting the email string through validation I get at a certain point:

protected '_viewParams' => 
    array (size=5)
      'title' => string 'Test' (length=5)
      'showSlider' => boolean true
      'hideUnlogged' => boolean true
      'user' => null
      'email' => boolean false

BUT the variables are sent to VOLT in an upper layer because it is still set as an ARRAY.

The only viable solution is to make an object or something and get from a config what validation rules to apply to forms (by name) and rewrite the post variable in public/index.php something like this:

if(isset($_POST['email']))
{
    $_POST['email'] = filter_var($_POST['email'], FILTER_VALIDATE_EMAIL);
}

If anyone has a better solution in which this can be done in a controller rather that this or in a service with event handlers...

Answer 1

You can do anything you wish by implementing a custom filter and doing a proper conversion from array to string.

$filter = new \Phalcon\Filter();

//Using an anonymous function
$filter->add('superSanitisedString', function($value) {
    if (is_array($value)) {
        $value = empty($value) ? '' : reset($value);
    }
    return (string) $value;
});

//Sanitize with the "superSanitisedString" filter
$filtered = $filter->sanitize($possibleArray, "superSanitisedString");

But… don't bend the stick too much – this is a clear validation job and then sanitisation. Check that the value is a string, if not – ask to provide one. It's easier and smarter to protect your app from invalid inputs than from idiots who provide that input :)

Edit:

You can use a custom volt filter which can be added as a service, implement a class with a static method to return the sanitized value and use it in the template.