range of parameter and values in php

Question

What is exact meaning of this statement...

VERIFY THE PARAMETER VALUE ARE IN THEIR EXPECTED RANGE AND TYPE.

I am passing values in POST method through URL in php.

Answer 1

It means that before you use the parameter that is passed throught POST in any of your statement you have to check wether it is in the correct format and, if applicable, range (ie. if you're gonna use it in a division, check if it's numerical and not zero).

Answer 2

if you expect a parameter to be an integer - check that it is. Also if you expect it to only be within a set range, say greater than zero but less than 128, check that too. Doing this will help safeguard your code from cross site scripting and other such nastiness.

Answer 3

This means that you should check that the parameters make sense.

For example, if there are 3 parameters expected: day-of-month (numerical), month (three-letter English abbreviations), year (4 digits),
that you'd reject day=32&month=5&year=98 (day is outside range, month is wrong type, year is wrong format),
but also day=29&month=Feb&year=2001 (2001 wasn't a leap year).

Answer 4

When talking about type it's talking about the type of variable to pass to the function. Tha means if you have

function conc(a,b){
   return a.b;
}

Don't past it 12 and 52 or any type of number. Pass it a parameter of type string.

And when talking about range, don't pass the function a type float when the function uses and int, etc...

---

But i wonder why you ask this question since PHP is dynamically typed. Unless you're type casting or such inside your fucntion.

Answer 5

It's saying you need to check if the variable is of the correct data type (integer, double, string, etc), and within some specified bounds (mininum/maximum value, precision, string length, etc).

Example:

function verifyTypeAndRange($var) {
    if(!is_int($var)) {
      //variable is not of the correct type (integer)
      return false;
    } else if($var < 0 || $var > 100) {
      //variable is not within required range (0-100)
      return false;
    }

    return true;
}

verifyTypeAndRange($_POST['var']);