Inject question (PHP)

NickM

@soluslabs said: filter_var($var ,FILTER_VALIDATE_INT) is not really what you want because you just need to find out if the variable is all numbers. This function will return true if the variable is negative (-12345)

filter_var($var, FILTER_VALIDATE_INT, array('options' => array('min_range' => 0)));

ctype_digit can be OK for user submitted form data, if that's all you're using it for. You have to make sure that you're only passing strings to it, otherwise you're going to get odd results - if you pass it an integer, it converts it to it's ASCII equivalent. For example, ctype_digit(57) === true, but ctype_digit(58) === false.

Perhaps the most important takeaway from this discussion is that if you're using a function to check something, then you need to make sure that you understand exactly what the functions do, especially in PHP where there are many different functions that on the surface appear to do the same thing, since it's rare that two functions actually do the exact same thing. tl;dr: RTFM to make absolutely sure that you're checking what you want to check.

soluslabs

@NickM said: Perhaps the most important takeaway from this discussion is that if you're using a function to check something, then you need to make sure that you understand exactly what the functions do, especially in PHP where there are many different functions that on the surface appear to do the same thing, since it's rare that two functions actually do the exact same thing. tl;dr: RTFM to make absolutely sure that you're checking what you want to check.

Very true. I'm not arguing with you on that one.

Like you say $_GET and $_POST data are always treated as strings so a basic call to ctype_digit() would do the trick.

soluslabs

Just for speed reference of the functions mentioned.

1000000 iterations each:

PHP 5.3.3

$var = "1000";

filter_var($var ,FILTER_VALIDATE_INT, array('options' => array('min_range' => 0)));
1.065

filter_var($var ,FILTER_VALIDATE_INT);
0.475

ctype_digit($var);
0.264

if (preg_match('/^[0-9]+$/', $var)) {}
0.814

netomx

Neat