|
| 1 | +# 4.2 Verification of inputs |
| 2 | + |
| 3 | +One of the most important principles in web development is that you cannot trust anything from client side user forms. You have to verify all incoming data before use it. Many websites are affected by this problem, which is simple yet crucial. |
| 4 | + |
| 5 | +There are two ways of verify form data that are commonly used. One is JavaScript verification in the front-end, and the other is server verification in the back-end. In this section, we are going to talk about server side verification in web development. |
| 6 | + |
| 7 | +## Required fields |
| 8 | + |
| 9 | +Sometimes we require that users input some fields but they don't, for example in the previous section when we required a username. You can use the `len` function to get the length of a field in order to ensure that users have entered this information. |
| 10 | + |
| 11 | + if len(r.Form["username"][0])==0{ |
| 12 | + // code for empty field |
| 13 | + } |
| 14 | + |
| 15 | +`r.Form` treats different form element types differently when they are blank. For empty textboxes, text areas and file uploads, it returns an empty string; for radio buttons and check boxes, it doesn't even create the corresponding items. Instead, you will get errors if you try to access it. Therefore, it's safer to use `r.Form.Get()` to get field values since it will always return empty if the value does not exist. On the other hand, `r.Form.Get()` can only get one field value at a time, so you need to use `r.Form` to get the map of values. |
| 16 | + |
| 17 | +## Numbers |
| 18 | + |
| 19 | +Sometimes you only need numbers for the field value. For example, let's say that you require the age of a user in integer form only, i.e 50 or 10, instead of "old enough" or "young man". If we require a positive number, we can convert the value to the `int` type first, then process it. |
| 20 | + |
| 21 | + getint,err:=strconv.Atoi(r.Form.Get("age")) |
| 22 | + if err!=nil{ |
| 23 | + // error occurs when convert to number, it may not a number |
| 24 | + } |
| 25 | + |
| 26 | + // check range of number |
| 27 | + if getint >100 { |
| 28 | + // too big |
| 29 | + } |
| 30 | + |
| 31 | +Another way to do this is using regular expressions. |
| 32 | + |
| 33 | + if m, _ := regexp.MatchString("^[0-9]+$", r.Form.Get("age")); !m { |
| 34 | + return false |
| 35 | + } |
| 36 | + |
| 37 | +For high performance purposes, regular expressions are not efficient, however simple regular expressions are usually fast enough. If you are familiar with regular expressions, it's a very convenient way to verify data. Notice that Go uses [RE2](http://code.google.com/p/re2/wiki/Syntax), so all UTF-8 characters are supported. |
| 38 | + |
| 39 | +## Chinese |
| 40 | + |
| 41 | +Sometimes we need users to input their Chinese names and we have to verify that they all use Chinese rather than random characters. For Chinese verification, regular expressions are the only way. |
| 42 | + |
| 43 | + if m, _ := regexp.MatchString("^[\\x{4e00}-\\x{9fa5}]+$", r.Form.Get("realname")); !m { |
| 44 | + return false |
| 45 | + } |
| 46 | + |
| 47 | +## English letters |
| 48 | + |
| 49 | +Sometimes we need users to input only English letters. For example, we require someone's English name, like astaxie instead of asta谢. We can easily use regular expressions to perform our verification. |
| 50 | + |
| 51 | + if m, _ := regexp.MatchString("^[a-zA-Z]+$", r.Form.Get("engname")); !m { |
| 52 | + return false |
| 53 | + } |
| 54 | + |
| 55 | +## E-mail address |
| 56 | + |
| 57 | +If you want to know whether users have entered valid E-mail addresses, you can use the following regular expression: |
| 58 | + |
| 59 | + if m, _ := regexp.MatchString(`^([\w\.\_]{2,10})@(\w{1,}).([a-z]{2,4})$`, r.Form.Get("email")); !m { |
| 60 | + fmt.Println("no") |
| 61 | + }else{ |
| 62 | + fmt.Println("yes") |
| 63 | + } |
| 64 | + |
| 65 | +## Drop down list |
| 66 | + |
| 67 | +Let's say we require an item from our drop down list, but instead we get a value fabricated by hackers. How do we prevent this from happening? |
| 68 | + |
| 69 | +Suppose we have the following `<select>`: |
| 70 | + |
| 71 | + <select name="fruit"> |
| 72 | + <option value="apple">apple</option> |
| 73 | + <option value="pear">pear</option> |
| 74 | + <option value="banana">banana</option> |
| 75 | + </select> |
| 76 | + |
| 77 | +We can use the following strategy to sanitize our input: |
| 78 | + |
| 79 | + slice:=[]string{"apple","pear","banana"} |
| 80 | + |
| 81 | + for _, v := range slice { |
| 82 | + if v == r.Form.Get("fruit") { |
| 83 | + return true |
| 84 | + } |
| 85 | + } |
| 86 | + return false |
| 87 | + |
| 88 | +All the functions I've shown above are in my open source project for operating on slices and maps: [https://github.com/astaxie/beeku](https://github.com/astaxie/beeku) |
| 89 | + |
| 90 | +## Radio buttons |
| 91 | + |
| 92 | +If we want to know whether the user is male or female, we may use a radio button, returning 1 for male and 2 for female. However, some little kid who just read his first book on HTTP, decides to send to you a 3. Will your program have have exception? As you can see, we need to use the same method as we did for our drop down list to make sure that only expected values are returned by our radio button. |
| 93 | + |
| 94 | + <input type="radio" name="gender" value="1">Male |
| 95 | + <input type="radio" name="gender" value="2">Female |
| 96 | + |
| 97 | +And we use following code to verify the input: |
| 98 | + |
| 99 | + slice:=[]int{1,2} |
| 100 | + |
| 101 | + for _, v := range slice { |
| 102 | + if v == r.Form.Get("gender") { |
| 103 | + return true |
| 104 | + } |
| 105 | + } |
| 106 | + return false |
| 107 | + |
| 108 | +## Check boxes |
| 109 | + |
| 110 | +Suppose there are some check boxes for user interests, and that you don't want extraneous values here either. |
| 111 | + |
| 112 | + <input type="checkbox" name="interest" value="football">Football |
| 113 | + <input type="checkbox" name="interest" value="basketball">Basketball |
| 114 | + <input type="checkbox" name="interest" value="tennis">Tennis |
| 115 | + |
| 116 | +In this case, the sanitization is a little bit different than verifying the button and check box inputs since here we get a slice from the check boxes. |
| 117 | + |
| 118 | + slice:=[]string{"football","basketball","tennis"} |
| 119 | + a:=Slice_diff(r.Form["interest"],slice) |
| 120 | + if a == nil{ |
| 121 | + return true |
| 122 | + } |
| 123 | + |
| 124 | + return false |
| 125 | + |
| 126 | +## Date and time |
| 127 | + |
| 128 | +Suppose you want users to input valid dates or times. Go has the `time` package for converting year, month and day to their corresponding times. After that, it's easy to check it. |
| 129 | + |
| 130 | + t := time.Date(2009, time.November, 10, 23, 0, 0, 0, time.UTC) |
| 131 | + fmt.Printf("Go launched at %s\n", t.Local()) |
| 132 | + |
| 133 | +After you have the time, you can use the `time` package for more operations, depending on your needs. |
| 134 | + |
| 135 | +In this section, we've discussed some common methods for verifying form data server side. I hope that you now understand more about data verification in Go, especially how to use regular expressions to your advantage. |
| 136 | + |
| 137 | +## Links |
| 138 | + |
| 139 | +- [Directory](preface.md) |
| 140 | +- Previous section: [Process form inputs](04.1.md) |
| 141 | +- Next section: [Cross site scripting](04.3.md) |
0 commit comments