Validation: Problem Solving, 90% of the Work
Web Development No Comments »When you program you'll quickly learn how fun it is, but the biggest lesson anyone will learn is the importance of validation. A good programmer is someone that foresees events that could possibly take place and cause an issue -- that doesn't mean they'll find every issue, but many. You have to play with what you create to invent possibilities of bugs seeping out so they won't happen.
Alternatively, there are design patterns that give you a nice clue how to handle this, but that's a little more advanced for someone less than 4 years in I think. There are also options of using application frameworks that will make this easier (like Symfony, CodeIgniter, and other MVC frameworks). At this juncture I prefer doing it by my own objects and functions rather than learning how a separate framework functions, though they are all fairly similar.
90% of Work in programming is validation in my opinion. It's easy to write procedural code, difficult to thoughtfully break it down into Object Oriented code, either way there must be validation. For example an unvalidated field that processes a query could be bad news if your MySQL strings don't escape correctly and someone intentionally or unintentionally breaks the database query and destroys a table, possibly the entire database. Safe queries wherever data is stored is one of the most important things, also checking for digits, regular expressions, and such are required in order to get an application run reliably and track issues fast. Even one field that processes a query incorrectly can disable an entire application, and running a complete system update is more work than having it taken care of in the first place.
I made a simple relational table to assign users to projects with an ID, project_id, and user_id.
Instead of breaking content into an array from one row like I previously had using an explode by ',', I went with new inserts per user/project assignment -- and must avoid duplicates since it's an insert.
Problems always arise with dirty strings, invalid strings, and duplicate content. I had to remove any potential to a duplicate so I figured these steps:
1. The creation only happens one time, so this can only apply to editing.
2. This will apply to the Edit section, so I have to pass a hidden variable to store the project ID, so I can chain it to this project ID. (Note: Not the same as project_id).
3. Since mysql_insert_id() would not work because this is an UPDATE not an INSERT I had to use the hidden variable I posted to find a relationship between the current project and the existing relational table. There is also no mysql_update_id() feature, which I wish there was!
// Process more users
if (isset($_POST['assign_users']))
{
foreach ($_POST['assign_users'] as $add_user)
{
// First Check for Duplicate Assignments
$check_duplicates = mysql_query("
SELECT * FROM project_users
WHERE `project_id`='$selectedProject'
AND `user_id`='$add_user'");
// Count Total Matches
$count = mysql_num_rows($check_duplicates);
// If No Duplicates, Proceed.
if ($count == 0)
{
$add_user = clean($add_user);
mysql_query("INSERT INTO project_users SET
`project_id`='$selectedProject',
`user_id`='$add_user'");
}
}
}
As you can see before the final query which loops (the one most tabbed over), a lot of validation goes into it. This is very minor considering the outside functions. It's easy to write a block of code, but if it's not protected correctly there is nothing good about it.

Recent Comments