How to sanitize input parameters with CMSMS? (the built-in mechanism)

[mihai11]

Hello,



I am trying to sanitize the input parameters using the mechanism that is built-in into CMSMS. For this purpose, in the function "SetParameters()" I am defining this:

Code: Select all

function SetParameters()
{
	$this->RestrictUnknownParams();
	$this->SetParameterType('step', CLEAN_STRING);
	$this->mCachable = false;
}

and in the file "action.default.php" I am trying to read the params like this:

Code: Select all

$step = $params['step'];
echo "step = '$step' <br />";

It doesn't matter how am I sending the 'step' parameter to the form - thru POST or GET. The 'step' is alsways empty.

If I am reading the parameters thru $_REQUEST, $_POST and $_GET everything seems to work:

Code: Select all

$step = $_REQUEST['step'];

but the variables are not "cleaned".

Please tell me what am I doing wrong.


Note: I am using the CMSMS version 1.5.4.



Regards,
Razvan

[alby]

Code: Select all

$step = $_REQUEST['step'];

You must use a CreateForm/CreateLink API's for sending.
This create a (about) m1_step if you look in $_REQUEST and step in $params

Alby

[mihai11]

Code: Select all

$step = $_REQUEST['step'];

You must use a CreateForm/CreateLink API's for sending.
This create a (about) m1_step if you look in $_REQUEST and step in $params

Alby

Thank you for your answer.

I've seen in the "News" plugin that they are using code like this:

Code: Select all

$step = $params['step'];

When should this be used?

Other observations:
1) Can't I just sanitize any parameter that is defined with a call to "SetParameterType"?
2) For a given module I might have many forms on different templates; Where should I call the CreateForm/CreateLink API's? Can you provide a fully functional example?



Regards,
Razvan

[alby]

Code: Select all

$step = $params['step'];

In general in your target (Form or Link is your source with your variables) or are params in your template tag

1) Can't I just sanitize any parameter that is defined with a call to "SetParameterType"?

Yes, if you use a param not set you have a error (depend of configuration will be displayed or not)

2) For a given module I might have many forms on different templates; Where should I call the CreateForm/CreateLink API's?

In your source, for example create your form with form's API:
CreateFormStart
CreateFormEnd
CreateInputSubmit
CreateLabelForInput
CreateInputText
CreateTextarea
.............
.............

Can you provide a fully functional example?

Look source in any "recent" module and play

Alby