Re: [PHP] checking user input of MM-DD-YYYY

2008-01-15 Thread Richard Heyes
I'm having users enter dates in MM-DD- format.  is there a way to 
check if what they have entered is invalid (like if they enter 1-15-2008 
instead of 01-15-2008) ?


Something like this:

http://www.phpguru.org/date_preg/

?php
// Get this from where ever (format MM-DD-)
echo ($input  = '01-02-2008') . 'br /br /';

$result = preg_match('/(\d{2})-(\d{2})-(\d{4})/', $input, $matches);

$date  = $matches[2]; // Note month/date switched
$month = $matches[1]; // Note month/date switched
$year  = $matches[3];

if (!$result) {
// Doesn't match...
}

echo Date: {$date}br /;
echo Month: {$month}br /;
echo Year: {$year}br /;
?


--
Richard Heyes
http://www.websupportsolutions.co.uk

Mailing list management service allowing you to reach your Customers
and increase your sales.

** NOW OFFERING FREE ACCOUNTS TO CHARITIES AND NON-PROFITS **

--
PHP General Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php



Re: [PHP] checking user input of MM-DD-YYYY

2008-01-15 Thread Nathan Nobbe
i think this ties into the thread tedd started a week or so ago
about the best approach for collecting user data.
it would be much easier to validate if there were 3 text input fields
to collect the data, rather than 1, free-form field.

-nathan


Re: [PHP] checking user input of MM-DD-YYYY

2008-01-15 Thread Tom Chubb
On 15/01/2008, Adam Williams [EMAIL PROTECTED] wrote:

 I'm having users enter dates in MM-DD- format.  is there a way to
 check if what they have entered is invalid (like if they enter 1-15-2008
 instead of 01-15-2008) ?

 --
 PHP General Mailing List (http://www.php.net/)
 To unsubscribe, visit: http://www.php.net/unsub.php


You could use check boxes to make sure you get the right format first time
and concatenate the results, or use strlen() to check there are enough
characters and/or a regular expression.


Re: [PHP] checking user input of MM-DD-YYYY

2008-01-15 Thread Nathan Nobbe
On Jan 15, 2008 9:30 AM, Per Jessen [EMAIL PROTECTED] wrote:

 Adam Williams wrote:

  I'm having users enter dates in MM-DD- format.  is there a way to
  check if what they have entered is invalid (like if they enter
  1-15-2008 instead of 01-15-2008) ?

 A regular expression perhaps?


you might also experiment w/ the date_parse() function.
http://us3.php.net/manual/en/function.date-parse.php

-nathan


Re: [PHP] checking user input of MM-DD-YYYY

2008-01-15 Thread Per Jessen
Adam Williams wrote:

 I'm having users enter dates in MM-DD- format.  is there a way to
 check if what they have entered is invalid (like if they enter
 1-15-2008 instead of 01-15-2008) ?

A regular expression perhaps?


/Per Jessen, Zürich

--
PHP General Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php



Re: [PHP] checking user input of MM-DD-YYYY

2008-01-15 Thread Per Jessen
Nathan Nobbe wrote:

 i think this ties into the thread tedd started a week or so ago
 about the best approach for collecting user data.
 it would be much easier to validate if there were 3 text input fields
 to collect the data, rather than 1, free-form field.

I would stick to one date field with a simple javascript validation
(using a regex) at entry time followed by a semantic check that the
given day exists in the given month/year. 
Of course, if you'd rather not use javascript, you could validate the
whole thing after POST.


/Per Jessen, Zürich

--
PHP General Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php



Re: [PHP] checking user input of MM-DD-YYYY

2008-01-15 Thread clive

Adam Williams wrote:
I'm having users enter dates in MM-DD- format.  is there a way to 
check if what they have entered is invalid (like if they enter 
1-15-2008 instead of 01-15-2008) ?



explode() and checkdate() perhaps?

--
PHP General Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php



Re: [PHP] checking user input of MM-DD-YYYY

2008-01-15 Thread Nathan Nobbe
On Jan 15, 2008 10:02 AM, Per Jessen [EMAIL PROTECTED] wrote:

 Nathan Nobbe wrote:

  i think this ties into the thread tedd started a week or so ago
  about the best approach for collecting user data.
  it would be much easier to validate if there were 3 text input fields
  to collect the data, rather than 1, free-form field.

 I would stick to one date field with a simple javascript validation
 (using a regex) at entry time followed by a semantic check that the
 given day exists in the given month/year.
 Of course, if you'd rather not use javascript, you could validate the
 whole thing after POST.


well obviously you want to validate on the server side no matter what.
validation only on the client side is a bad practice.

-nathan


Re: [PHP] checking user input of MM-DD-YYYY

2008-01-15 Thread Richard Lynch


On Tue, January 15, 2008 9:02 am, Per Jessen wrote:
 Nathan Nobbe wrote:

 i think this ties into the thread tedd started a week or so ago
 about the best approach for collecting user data.
 it would be much easier to validate if there were 3 text input
 fields
 to collect the data, rather than 1, free-form field.

 I would stick to one date field with a simple javascript validation
 (using a regex) at entry time followed by a semantic check that the
 given day exists in the given month/year.
 Of course, if you'd rather not use javascript, you could validate the
 whole thing after POST.

You have to validate after POST anyway; The JS can be bypassed/off.

JS validation is eye-candy and reduces strain on the server by legit
users.  It is in no way, shape, or form to be considered actual
validation of incoming data.

-- 
Some people have a gift link here.
Know what I want?
I want you to buy a CD from some indie artist.
http://cdbaby.com/from/lynch
Yeah, I get a buck. So?

-- 
PHP General Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php



Re: [PHP] checking user input of MM-DD-YYYY

2008-01-15 Thread Daniel Brown
On Jan 15, 2008 10:38 AM, Richard Lynch [EMAIL PROTECTED] wrote:


 On Tue, January 15, 2008 9:02 am, Per Jessen wrote:
  Nathan Nobbe wrote:
 
  i think this ties into the thread tedd started a week or so ago
  about the best approach for collecting user data.
  it would be much easier to validate if there were 3 text input
  fields
  to collect the data, rather than 1, free-form field.
 
  I would stick to one date field with a simple javascript validation
  (using a regex) at entry time followed by a semantic check that the
  given day exists in the given month/year.
  Of course, if you'd rather not use javascript, you could validate the
  whole thing after POST.

 You have to validate after POST anyway; The JS can be bypassed/off.

 JS validation is eye-candy and reduces strain on the server by legit
 users.  It is in no way, shape, or form to be considered actual
 validation of incoming data.

I was going to say the exact same thing, almost verbatim.

By only doing JavaScript validation, you're not guaranteed to get
the correct information from smart phones, Lynx users (some of us
still exist!), or a handful of other legitimate web surfers let
alone those who may choose to post to your form using cURL.  :-o

-- 
/Dan

Daniel P. Brown
Senior Unix Geek and #1 Rated Year's Coolest Guy By Self Since
Nineteen-Seventy-[mumble].

-- 
PHP General Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php



Re: [PHP] checking user input of MM-DD-YYYY

2008-01-15 Thread Per Jessen
Daniel Brown wrote:

 By only doing JavaScript validation, 

Just in case - I wasn't suggesting only doing javascript validation.  I
think I said a simple javascript validation _followed_ (as in at
POST-time) by a semantic check. For which checkdate() seems pretty
optimal. 


/Per Jessen, Zürich

--
PHP General Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php



Re: [PHP] checking user input of MM-DD-YYYY

2008-01-15 Thread Per Jessen
clive wrote:

 Adam Williams wrote:
 I'm having users enter dates in MM-DD- format.  is there a way to
 check if what they have entered is invalid (like if they enter
 1-15-2008 instead of 01-15-2008) ?

 explode() and checkdate() perhaps?

checkdate() sounds like just the thing. 


/Per Jessen, Zürich

--
PHP General Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php



Re: [PHP] checking user input of MM-DD-YYYY

2008-01-15 Thread Nathan Nobbe
On Jan 15, 2008 10:46 AM, Daniel Brown [EMAIL PROTECTED] wrote:

 On Jan 15, 2008 10:38 AM, Richard Lynch [EMAIL PROTECTED] wrote:
 
 
  On Tue, January 15, 2008 9:02 am, Per Jessen wrote:
   Nathan Nobbe wrote:
  
   i think this ties into the thread tedd started a week or so ago
   about the best approach for collecting user data.
   it would be much easier to validate if there were 3 text input
   fields
   to collect the data, rather than 1, free-form field.
  
   I would stick to one date field with a simple javascript validation
   (using a regex) at entry time followed by a semantic check that the
   given day exists in the given month/year.
   Of course, if you'd rather not use javascript, you could validate the
   whole thing after POST.
 
  You have to validate after POST anyway; The JS can be bypassed/off.
 
  JS validation is eye-candy and reduces strain on the server by legit
  users.  It is in no way, shape, or form to be considered actual
  validation of incoming data.

I was going to say the exact same thing, almost verbatim.

By only doing JavaScript validation, you're not guaranteed to get
 the correct information from smart phones, Lynx users (some of us
 still exist!), or a handful of other legitimate web surfers let
 alone those who may choose to post to your form using cURL.  :-o


and the best part is youre susceptible to attackers who want to inject
invalid data into your script to see what they can break ;)

-nathan


Re: [PHP] checking user input of MM-DD-YYYY

2008-01-15 Thread Eric Butera
On Jan 15, 2008 9:27 AM, Adam Williams [EMAIL PROTECTED] wrote:

 I'm having users enter dates in MM-DD- format.  is there a way to
 check if what they have entered is invalid (like if they enter 1-15-2008
 instead of 01-15-2008) ?

 --
 PHP General Mailing List (http://www.php.net/)
 To unsubscribe, visit: http://www.php.net/unsub.php



strtotime() might be an option too.


Re: [PHP] checking user input of MM-DD-YYYY

2008-01-15 Thread Richard Lynch


On Tue, January 15, 2008 8:27 am, Adam Williams wrote:
 I'm having users enter dates in MM-DD- format.  is there a way to
 check if what they have entered is invalid (like if they enter
 1-15-2008
 instead of 01-15-2008) ?

Making the user type the 0 is just plain rude. :-)

You could use a javascript popup calendar to make MOST users have it
the way you want.

And something like this can validate what you think you want:
if (preg_match('/^([0-9]{2}-[0-9]{2}-[0-9]{4}$/', $date, $date_parts)){
  list($month, $day, $year) = $date_parts[1];
  $unixdate = mktime(1, 0, 0, $month, $day, $year);
  $crosscheck = date('M-d-Y', $unixdate); //Is M for zero-padded month?
  if ($crosscheck != $date_parts[0]) error();
}
else error();

-- 
Some people have a gift link here.
Know what I want?
I want you to buy a CD from some indie artist.
http://cdbaby.com/from/lynch
Yeah, I get a buck. So?

-- 
PHP General Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php



Re: [PHP] checking user input of MM-DD-YYYY

2008-01-15 Thread Adam Williams

Thanks, I think I have it:

$dateexplode = explode(-, $_POST[date_entered]);
if (!preg_match(/^(\d{2})$/, $dateexplode[0],$data1) ||
!preg_match(/^(\d{2})$/, $dateexplode[1],$data2) ||
!preg_match(/^(\d{4})$/, $dateexplode[2],$data3))
   {
   die (you have entered an invalid date);
   }

so if the person enters 01-15-2008 its fine, but 1-15-2008 dies.

--
PHP General Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php



Re: [PHP] checking user input of MM-DD-YYYY

2008-01-15 Thread Andrew Ballard
On Jan 15, 2008 11:25 AM, Adam Williams [EMAIL PROTECTED] wrote:
 Thanks, I think I have it:

 $dateexplode = explode(-, $_POST[date_entered]);
 if (!preg_match(/^(\d{2})$/, $dateexplode[0],$data1) ||
 !preg_match(/^(\d{2})$/, $dateexplode[1],$data2) ||
 !preg_match(/^(\d{4})$/, $dateexplode[2],$data3))
 {
 die (you have entered an invalid date);
 }

 so if the person enters 01-15-2008 its fine, but 1-15-2008 dies.


Just curious why you won't take 1-15-2008. Once you validate it, you
can always assign it to a variable as either a timestamp or a DateTime
object and then format it however you want when you display it, send
it to a database, or whatever you are doing with the date.

FWIW, what you have above will also accept 42-75-2008.

Andrew

-- 
PHP General Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php



Re: [PHP] checking user input of MM-DD-YYYY

2008-01-15 Thread Per Jessen
Adam Williams wrote:

 Thanks, I think I have it:
 
 $dateexplode = explode(-, $_POST[date_entered]);
 if (!preg_match(/^(\d{2})$/, $dateexplode[0],$data1) ||
 !preg_match(/^(\d{2})$/, $dateexplode[1],$data2) ||
 !preg_match(/^(\d{4})$/, $dateexplode[2],$data3))
 {
 die (you have entered an invalid date);
 }
 
 so if the person enters 01-15-2008 its fine, but 1-15-2008 dies.

Running three regexes is a bit much when one is enough:

/^([0-9]{2})-([0-9]{2})-([0-9]{4})$/



/Per Jessen, Zürich

--
PHP General Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php



Re: [PHP] checking user input of MM-DD-YYYY

2008-01-15 Thread Adam Williams



Andrew Ballard wrote:

Just curious why you won't take 1-15-2008. Once you validate it, you
can always assign it to a variable as either a timestamp or a DateTime
object and then format it however you want when you display it, send
it to a database, or whatever you are doing with the date.

FWIW, what you have above will also accept 42-75-2008.

Andrew

  
Because I'm inserting it into MySQL as a date conversion from American 
date to a MySQL date field. %m must be ##, %d must be ##, and %Y must be 
. so if %m or %d is set to 1 - 9 and not 01 - 09 it will error.



$mysqli_insert_sql = INSERT INTO contract (user_id, cwcv,
amount, responsibility, length_start, length_end, stage, title, lastmod, 
divdirdate)

VALUES ( '$user_id', '. $_POST[cwcv].', '.$_POST[amount].',
'.$_POST[responsibility].',
STR_TO_DATE('.$_POST[length_start].', '%m-%d-%Y'),
STR_TO_DATE('.$_POST[length_end].', '%m-%d-%Y'), '1',
'.$_POST[title].', now(), now());

--
PHP General Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php



Re: [PHP] checking user input of MM-DD-YYYY

2008-01-15 Thread Daniel Brown
On Jan 15, 2008 11:51 AM, Adam Williams [EMAIL PROTECTED] wrote:


 Andrew Ballard wrote:
  Just curious why you won't take 1-15-2008. Once you validate it, you
  can always assign it to a variable as either a timestamp or a DateTime
  object and then format it however you want when you display it, send
  it to a database, or whatever you are doing with the date.
 
  FWIW, what you have above will also accept 42-75-2008.
 
  Andrew
 
 
 Because I'm inserting it into MySQL as a date conversion from American
 date to a MySQL date field. %m must be ##, %d must be ##, and %Y must be
 . so if %m or %d is set to 1 - 9 and not 01 - 09 it will error.


 $mysqli_insert_sql = INSERT INTO contract (user_id, cwcv,
 amount, responsibility, length_start, length_end, stage, title, lastmod,
 divdirdate)
 VALUES ( '$user_id', '. $_POST[cwcv].', '.$_POST[amount].',
 '.$_POST[responsibility].',
 STR_TO_DATE('.$_POST[length_start].', '%m-%d-%Y'),
 STR_TO_DATE('.$_POST[length_end].', '%m-%d-%Y'), '1',
 '.$_POST[title].', now(), now());

Then don't bother with date validation in that respect.  Instead,
just use tandem functions:

?
function mysql_date($m,$d,$y) {
if(!is_numeric($m) || !is_numeric($d) || !is_numeric($y)) {
return Failed due to improper input;
}
return date(m-d-Y,mktime(0,0,0,$m,$d,$y));
}

echo mysql_date($month,$day,$year).\n;
?

-- 
/Dan

Daniel P. Brown
Senior Unix Geek and #1 Rated Year's Coolest Guy By Self Since
Nineteen-Seventy-[mumble].

-- 
PHP General Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php



Re: [PHP] checking user input of MM-DD-YYYY

2008-01-15 Thread Andrew Ballard
On Jan 15, 2008 11:51 AM, Adam Williams [EMAIL PROTECTED] wrote:


 Andrew Ballard wrote:
  Just curious why you won't take 1-15-2008. Once you validate it, you
  can always assign it to a variable as either a timestamp or a DateTime
  object and then format it however you want when you display it, send
  it to a database, or whatever you are doing with the date.
 
  FWIW, what you have above will also accept 42-75-2008.
 
  Andrew
 
 
 Because I'm inserting it into MySQL as a date conversion from American
 date to a MySQL date field. %m must be ##, %d must be ##, and %Y must be
 . so if %m or %d is set to 1 - 9 and not 01 - 09 it will error.


 $mysqli_insert_sql = INSERT INTO contract (user_id, cwcv,
 amount, responsibility, length_start, length_end, stage, title, lastmod,
 divdirdate)
 VALUES ( '$user_id', '. $_POST[cwcv].', '.$_POST[amount].',
 '.$_POST[responsibility].',
 STR_TO_DATE('.$_POST[length_start].', '%m-%d-%Y'),
 STR_TO_DATE('.$_POST[length_end].', '%m-%d-%Y'), '1',
 '.$_POST[title].', now(), now());




All the more reason I would turn it into a timestamp or DateTime
object in PHP first. That will prevent trying to insert something like
what I used above. Then I would get rid of the MySQL STR_TO_DATE
function in the $mysqli_insert_sql value just replace it with
something like this:

date('Y-m-d', $length_start)

If you enter it in that format MySQL will get it right without regard
to locale settings.

I hope that you are sanitizing the rest of the input as well, and not
just shoving unchecked POST data into a database. Your example is a
SQL injection attack waiting to be exploited.

Andrew

-- 
PHP General Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php



Re: [PHP] checking user input of MM-DD-YYYY

2008-01-15 Thread Jim Lucas

Adam Williams wrote:
I'm having users enter dates in MM-DD- format.  is there a way to 
check if what they have entered is invalid (like if they enter 1-15-2008 
instead of 01-15-2008) ?




$utime = strtotime($_POST['input']);

if ( $utime !== false 
$_POST['input'] == date('m-d-Y', $utime) ) {
$mysql_date = date('Y-m-d', $utime);
// valid date and format
// use $mysql_date for whatever now
}
else error();


The above will take what ever is entered, as long as it is a valid date, 
and convert it to a timestamp.  Then it converts it back to a date, 
formatted like the original.  If they match, the it is valid.  If they 
don't match, well then...



--
Jim Lucas

   Some men are born to greatness, some achieve greatness,
   and some have greatness thrust upon them.

Twelfth Night, Act II, Scene V
by William Shakespeare

--
PHP General Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php



Re: [PHP] checking user input of MM-DD-YYYY

2008-01-15 Thread Nathan Nobbe
On Jan 15, 2008 1:31 PM, Adam Williams [EMAIL PROTECTED] wrote:

 Andrew Ballard wrote:
  All the more reason I would turn it into a timestamp or DateTime
  object in PHP first. That will prevent trying to insert something like
  what I used above. Then I would get rid of the MySQL STR_TO_DATE
  function in the $mysqli_insert_sql value just replace it with
  something like this:
 
  date('Y-m-d', $length_start)
 
  If you enter it in that format MySQL will get it right without regard
  to locale settings.
 
  I hope that you are sanitizing the rest of the input as well, and not
  just shoving unchecked POST data into a database. Your example is a
  SQL injection attack waiting to be exploited.
 
  Andrew
 
 

 I'm running mysql_real_escape_string(); on all of the variables prior to
 inserting/updating them.

 I don't see the point in needing to convert it to a timestamp.  The
 length_start and length_end fields in MySQL are defined as date fields.
 All I care about is the date, not the hours/minutes/seconds.  If I
 insert it as date('Y-m-d', $length_start) then when I SELECT it back
 out, I will still have to do a date conversion back to MM-DD- when I
 display it to the user.


you might want to ensure the syntactically correct date is also semantically
correct.
the code jim posted will ensure the date entered by the user actually
exists.

experiment w/ these 2 values using the code from his post.
$_POST['input'] = '10-10-2007';   // passes
$_POST['input'] = '20-10-2007';   // fails

-nathan


Re: [PHP] checking user input of MM-DD-YYYY

2008-01-15 Thread Brady Mitchell
I'm having users enter dates in MM-DD- format.  is there a way  
to check if what they have entered is invalid (like if they enter  
1-15-2008 instead of 01-15-2008) ?


Why not use something like http://www.dynarch.com/projects/calendar/  
to make it easier for the users? Along with being easier, the widget  
will format the input however you like. You can even have it displayed  
to the user in one format and post it to your form in another format.


Of course there should also be an alternative method  for those with  
JS turned off, but my experience with users entering dates by hand has  
been way too painful not to use a JS calendar widget.


Just my two cents,

Brady

--
PHP General Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php



Re: [PHP] checking user input of MM-DD-YYYY

2008-01-15 Thread Andrew Ballard
On Jan 15, 2008 1:31 PM, Adam Williams [EMAIL PROTECTED] wrote:
 Andrew Ballard wrote:
  All the more reason I would turn it into a timestamp or DateTime
  object in PHP first. That will prevent trying to insert something like
  what I used above. Then I would get rid of the MySQL STR_TO_DATE
  function in the $mysqli_insert_sql value just replace it with
  something like this:
 
  date('Y-m-d', $length_start)
 
  If you enter it in that format MySQL will get it right without regard
  to locale settings.
 
  I hope that you are sanitizing the rest of the input as well, and not
  just shoving unchecked POST data into a database. Your example is a
  SQL injection attack waiting to be exploited.
 
  Andrew
 
 

 I'm running mysql_real_escape_string(); on all of the variables prior to
 inserting/updating them.

 I don't see the point in needing to convert it to a timestamp.  The
 length_start and length_end fields in MySQL are defined as date fields.
 All I care about is the date, not the hours/minutes/seconds.  If I
 insert it as date('Y-m-d', $length_start) then when I SELECT it back
 out, I will still have to do a date conversion back to MM-DD- when I
 display it to the user.


The reason I would convert it to a timestamp or a DateTime is simply
because it is a date, not a string. I know PHP is loosely typed, but I
still try to use the correct type for anything I store in a variable.
(I also wait to run variables through escape functions like
mysql_real_escape_string only when I pass them to something that
requires the escaping since the escape characters are not part of the
actual data.)

If you are using a date column in MySQL, it will be stored and
retrieved as -MM-DD no matter how you specify it. MySQL has a date
type that doesn't include a time portion, so you still wouldn't need
to worry about the hours/minutes/seconds. In fact, if you are using
STR_TO_DATE, you are letting MySQL do the same thing for you. The
difference is that if you check the value in PHP, you can catch an
invalid date before you send the query to insert the row, rather than
letting MySQL insert it and massage the value to NULL because it isn't
a real date. (STR_TO_DATE('20-10-2008', '%m-%d-%Y') returns NULL) At
any rate, you'll still get the date back as -MM-DD unless you use
MySQL's date functions to format it the way you want to see it.

Andrew

-- 
PHP General Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php



Re: [PHP] checking user input of MM-DD-YYYY

2008-01-15 Thread Adam Williams

Andrew Ballard wrote:

All the more reason I would turn it into a timestamp or DateTime
object in PHP first. That will prevent trying to insert something like
what I used above. Then I would get rid of the MySQL STR_TO_DATE
function in the $mysqli_insert_sql value just replace it with
something like this:

date('Y-m-d', $length_start)

If you enter it in that format MySQL will get it right without regard
to locale settings.

I hope that you are sanitizing the rest of the input as well, and not
just shoving unchecked POST data into a database. Your example is a
SQL injection attack waiting to be exploited.

Andrew

  


I'm running mysql_real_escape_string(); on all of the variables prior to 
inserting/updating them.


I don't see the point in needing to convert it to a timestamp.  The 
length_start and length_end fields in MySQL are defined as date fields.  
All I care about is the date, not the hours/minutes/seconds.  If I 
insert it as date('Y-m-d', $length_start) then when I SELECT it back 
out, I will still have to do a date conversion back to MM-DD- when I 
display it to the user.


--
PHP General Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php



Re: [PHP] checking user input of MM-DD-YYYY

2008-01-15 Thread Andrew Ballard
On Jan 15, 2008 2:05 PM, Brady Mitchell [EMAIL PROTECTED] wrote:
  I'm having users enter dates in MM-DD- format.  is there a way
  to check if what they have entered is invalid (like if they enter
  1-15-2008 instead of 01-15-2008) ?

 Why not use something like http://www.dynarch.com/projects/calendar/
 to make it easier for the users? Along with being easier, the widget
 will format the input however you like. You can even have it displayed
 to the user in one format and post it to your form in another format.

 Of course there should also be an alternative method  for those with
 JS turned off, but my experience with users entering dates by hand has
 been way too painful not to use a JS calendar widget.

 Just my two cents,

 Brady

As a programmer, I tend to agree. However, I've worked with enough
people who felt that the time required to move your hand from the
keyboard to a mouse, click on what you want, and move back to the
keyboard to continue entering data on the form took too long to be
productive. This can be especially true for calendar widgets when you
have to change years. (Try a calendar widget for birthdate field or
something where you may have to set the year back more than 20 --
especially if the GUI designer only made buttons to scroll 1
month/year at a time.)

Thinking back, I worked at one place about 8 years ago that had a
regular Windows based GUI for the billing system. I was surprised to
walk into a training class and see the instructor teaching the new
hires how to enter information in the screens without using the mouse
at all. (She hid the mice so they didn't have a choice.)

On one of the last projects I worked on, we made all of our date
fields with the popup calendars and made several of the text fields
readonly (because we wanted users to use the calendars so we could
reduce entry errors). After a while, we had so many requests to make
the fields editable again that we did just that.

Andrew

-- 
PHP General Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php



Re: [PHP] checking user input of MM-DD-YYYY

2008-01-15 Thread Nathan Nobbe
On Jan 15, 2008 2:24 PM, Andrew Ballard [EMAIL PROTECTED] wrote:

 On Jan 15, 2008 2:05 PM, Brady Mitchell [EMAIL PROTECTED] wrote:
   I'm having users enter dates in MM-DD- format.  is there a way
   to check if what they have entered is invalid (like if they enter
   1-15-2008 instead of 01-15-2008) ?
 
  Why not use something like http://www.dynarch.com/projects/calendar/
  to make it easier for the users? Along with being easier, the widget
  will format the input however you like. You can even have it displayed
  to the user in one format and post it to your form in another format.
 
  Of course there should also be an alternative method  for those with
  JS turned off, but my experience with users entering dates by hand has
  been way too painful not to use a JS calendar widget.
 
  Just my two cents,
 
  Brady

 As a programmer, I tend to agree. However, I've worked with enough
 people who felt that the time required to move your hand from the
 keyboard to a mouse, click on what you want, and move back to the
 keyboard to continue entering data on the form took too long to be
 productive. This can be especially true for calendar widgets when you
 have to change years. (Try a calendar widget for birthdate field or
 something where you may have to set the year back more than 20 --
 especially if the GUI designer only made buttons to scroll 1
 month/year at a time.)

 Thinking back, I worked at one place about 8 years ago that had a
 regular Windows based GUI for the billing system. I was surprised to
 walk into a training class and see the instructor teaching the new
 hires how to enter information in the screens without using the mouse
 at all. (She hid the mice so they didn't have a choice.)

 On one of the last projects I worked on, we made all of our date
 fields with the popup calendars and made several of the text fields
 readonly (because we wanted users to use the calendars so we could
 reduce entry errors). After a while, we had so many requests to make
 the fields editable again that we did just that.


allowing free-form entry and the widget is nice, especially if proper
validation
is in place no matter what.  i have the dynarch widget on  the current app
im
building and it took 3 clicks to get my birthday.
one to open the widget
one to select the month
one to select the day
i dont think thats too bad (but i did know about the month ddl you can get
by
holding the mouse down over a portion of the widget).  going back 20 years
is
only 3 clicks away as well.

-nathan


Re: [PHP] checking user input of MM-DD-YYYY

2008-01-15 Thread Richard Lynch
On Tue, January 15, 2008 12:31 pm, Adam Williams wrote:
 Andrew Ballard wrote:
 I don't see the point in needing to convert it to a timestamp.  The
 length_start and length_end fields in MySQL are defined as date
 fields.
 All I care about is the date, not the hours/minutes/seconds.  If I
 insert it as date('Y-m-d', $length_start) then when I SELECT it back
 out, I will still have to do a date conversion back to MM-DD- when
 I
 display it to the user.

No.

MySQL is going to store it internally however it wants, regardless of
how you get it in there.

And you'll want to format it (or use MySQL default) independent of
what you use to get it in there.

-- 
Some people have a gift link here.
Know what I want?
I want you to buy a CD from some indie artist.
http://cdbaby.com/from/lynch
Yeah, I get a buck. So?

-- 
PHP General Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php



Re: [PHP] checking user input of MM-DD-YYYY

2008-01-15 Thread Andrew Ballard
On Jan 15, 2008 2:38 PM, Richard Lynch [EMAIL PROTECTED] wrote:
 On Tue, January 15, 2008 12:31 pm, Adam Williams wrote:
  Andrew Ballard wrote:
  I don't see the point in needing to convert it to a timestamp.  The
  length_start and length_end fields in MySQL are defined as date
  fields.
  All I care about is the date, not the hours/minutes/seconds.  If I
  insert it as date('Y-m-d', $length_start) then when I SELECT it back
  out, I will still have to do a date conversion back to MM-DD- when
  I
  display it to the user.

 No.

Well, true. I guess what I meant is that MySQL requires to be entered
as -MM-DD, and they always (at least that I've seen) comes back
out the same way. I don't really know how it's actually stored. I'm
sure that depends on the engine as well.

 MySQL is going to store it internally however it wants, regardless of
 how you get it in there.

 And you'll want to format it (or use MySQL default) independent of
 what you use to get it in there.

Exactly.

-- 
PHP General Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php