Using the form-variable filter

By David Rodriguez (dvr@arsdigita.com)

What it does:

The form-variable filter allows you to specify datatypes for url variables. For example, you could specify that user_id is always an integer, and if anyone passes in anything else, the page will throw an error.

It's possible to restrict filters to certain url patterns, which is necessary if you use the same variable name in different modules. For example, you could restrict $my_key to be an integer under /module_one/* and a character string when used under /module_two/*.

The filters allows you to specify wild-card patterns, so you can specify rules like 'bboard_id is a character string, but all other *_id variables are integers.'

Usage

ad_set_typed_form_variable_filter url_pattern list_of_variables_to_filter

list_of_variables_to_filter is a list of lists that specifies (1) the variable to check, and (2) the datatype that we expect.

Examples:

Under /bboard/*, topic_id must an integer, and msg_id must be a 'word' (a string that contains only letters, numbers, dashes, and underscores.)

ad_set_typed_form_variable_filter /bboard/* {msg_id word} {topic_id integer}

The default datatype is 'integer', which would allow you to write the spec above as

ad_set_typed_form_variable_filter /bboard/* {msg_id word} topic_id

Datatypes

integer
number Any real number. We check its validity by asking Tcl to do math with it.
word A string that contains only letters, numbers, dashes, and underscores.
noquote A string that contains no single quotes. Use this when a string is allowed to have spaces, but not quotes. (Dates fit into this category.)
integerlist A string that contains only numbers, spaces, and commas (but no negative numbers, because this would allow people to sneak in math.)
safefilename A filename that doesn't contain '..' in it.
dirname A string that doesn't have / or \ in it.
fail The check should fail regardless of value.
nocheck The check should pass regardless of value

The nocheck operator is useful if you want to specify blanket rules, then create a few exceptions. For example, if all the variables on the site that end with _key were integers, except for $long_key, which is a string that could contain any letter (including quotes), you could write the spec

ad_set_typed_form_variable_filter /* {long_key nocheck} *_key

The fail operator is used when you want to turn off access to a page by not allowing any url variables to be set.

ad_set_typed_form_variable_filter /* {user_id_to_delete fail}

What this filter protects against