Don't trust your users
summary
Shows concrete fixes: PHP’s built‑in filter module (present since 5.2) and filter_var / filter_var_array for ints floats emails IPs URLs and basic sanitization; when that’s insufficient, pulls in aura.filter or framework validators (Zend, Symfony2 forms/annotations) or custom callbacks; demonstrates rule types like soft rules vs hard/stop, validator chaining, and sanitizers; uses contact‑form examples and the BestBuy price‑tampering anecdote, claims filter_validate_email handles ~99% of cases, and recommends using libraries not hand‑rolled regex.
AI-written summary · about
chapters (8)
- 0:00Introduction
- 3:52Cannot trust user input
- 6:42Client-side limits
- 11:19PHP filter module
- 21:55Aura.filter validation
- 30:05Framework validation
- 34:00Validation best practices
- 37:26When to validate
related talks
43mData validation models
01h 01mSecurity: From basic principles to PHP specifics
28mThe Art of Form Validation
02h 18mWeb application security (Part 2)
25mLittle Bobby Tables: Understanding Data Validation and Sanitization
44mFind security vulnerabilities through code review
10mIntroduction to web security
57mThe Last XSS Defense Talk