1

Is there a way to find errors caused by crafted input in php, such as naming POST-fields like variable[] instead of variable, causing PHP to implicitly convert it into an array, by using some form of automated testing?

  • Could you detail the kind of testing you have in mind? Ideally whatever code consumes the POST data would have its own validation logic. – Darien May 4 '14 at 8:43
1

Use type assertions as annotations in the code:

class Author
{
    /**
     * @Assert\Type("string")
     */
    protected $firstName;

    /**
     * @Assert\Type(
     *     type="integer",
     *     message="The value {{ value }} is not a valid {{ type }}."
     * )
     */
    protected $age;
}

Or settype in the tests themselves:

$foo = "42";
echo gettype($foo); // Yields "string"
// Here we change the type from string -> integer
settype($foo, "integer");
echo gettype($foo); // Yields "integer"

References

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.