1

Is there a way to find errors caused by crafted input in php, such as naming POST-fields like variable[] instead of variable, causing PHP to implicitly convert it into an array, by using some form of automated testing?

1
  • Could you detail the kind of testing you have in mind? Ideally whatever code consumes the POST data would have its own validation logic.
    – Darien
    Commented May 4, 2014 at 8:43

1 Answer 1

1

Use type assertions as annotations in the code:

class Author
{
    /**
     * @Assert\Type("string")
     */
    protected $firstName;

    /**
     * @Assert\Type(
     *     type="integer",
     *     message="The value {{ value }} is not a valid {{ type }}."
     * )
     */
    protected $age;
}

Or settype in the tests themselves:

$foo = "42";
echo gettype($foo); // Yields "string"
// Here we change the type from string -> integer
settype($foo, "integer");
echo gettype($foo); // Yields "integer"

References

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.