Actions

J1.5

Difference between revisions of "Retrieving and Filtering GET and POST requests with JRequest::getVar"

From Joomla! Documentation

(combining 2 articles about Jrequest into this one + Improving style a bit)
Line 1: Line 1:
 
{{stub}}
 
{{stub}}
 +
When writing any web application, it is crucial that you filter input data before using it. Joomla! provides a set of filtering libraries to help you accomplish this.
  
 +
===Defined in===
 +
libraries\joomla\environment\request.php
  
== Summary ==
+
==Methods==
 
+
When writing any web application, it is crucial that you filter input data before using it. Joomla! provides a set of filtering libraries to help you accomplish this.
+
 
+
  
== JRequest 'getVar' method ==
+
=== 'getVar' ===
 
To retrieve GET/POST request data, Joomla! uses the getVar method of the JRequest class (JRequest::getVar()).
 
To retrieve GET/POST request data, Joomla! uses the getVar method of the JRequest class (JRequest::getVar()).
  
Line 13: Line 13:
  
 
If you have a form variable named 'address', you would want to use this code to get it:
 
If you have a form variable named 'address', you would want to use this code to get it:
 
+
<source lang="php">
''EXAMPLE:''
+
<pre>
+
 
$address = JRequest::getVar('address');
 
$address = JRequest::getVar('address');
</pre>
+
</source>
  
 
Unless other parameters are set, all HTML and trailing whitespace will be filtered out.
 
Unless other parameters are set, all HTML and trailing whitespace will be filtered out.
Line 25: Line 23:
 
If you want to specify a default value in the event that 'address' is not in the request or is unset, use this code:
 
If you want to specify a default value in the event that 'address' is not in the request or is unset, use this code:
  
''EXAMPLE:''
+
<source lang="php">
<pre>
+
 
$address = JRequest::getVar('address', 'Address is empty');
 
$address = JRequest::getVar('address', 'Address is empty');
 
echo $address;  // Address is empty
 
echo $address;  // Address is empty
</pre>
+
</source>
  
 
'''The SOURCE Parameter'''
 
'''The SOURCE Parameter'''
Line 35: Line 32:
 
Frequently, you will expect your variable to be found in a specific portion of the HTTP request (POST, GET, etc...). If this is the case, you should specify which portion; this will slightly increase your extension's security. If you expect 'address' to only be in POST, use this code to enforce that:
 
Frequently, you will expect your variable to be found in a specific portion of the HTTP request (POST, GET, etc...). If this is the case, you should specify which portion; this will slightly increase your extension's security. If you expect 'address' to only be in POST, use this code to enforce that:
  
''EXAMPLE:''
+
<source lang="php">
<pre>
+
 
$address = JRequest::getVar('address', 'default value goes here', 'post');
 
$address = JRequest::getVar('address', 'default value goes here', 'post');
</pre>
+
</source>
  
 
'''The VARIABLE TYPE Parameter'''
 
'''The VARIABLE TYPE Parameter'''
Line 44: Line 40:
 
The fourth parameter of getVar() can be used to specify certain filters to force validation of specific value types for the variable.  
 
The fourth parameter of getVar() can be used to specify certain filters to force validation of specific value types for the variable.  
  
''EXAMPLE:''
+
<source lang="php">
<pre>
+
 
$address = JRequest::getVar('address', 'default value goes here', 'post','variable type');
 
$address = JRequest::getVar('address', 'default value goes here', 'post','variable type');
</pre>
+
</source>
  
 
Here is a list of types you can validate:
 
Here is a list of types you can validate:
Line 69: Line 64:
  
 
Finally, there are some mask constants you can pass in as the fifth parameter that allow you to bypass portions of the filtering:
 
Finally, there are some mask constants you can pass in as the fifth parameter that allow you to bypass portions of the filtering:
 
+
<source lang="php">
''EXAMPLE:''
+
<pre>
+
 
$address = JRequest::getVar('address', 'default value goes here', 'post','validation type','mask type');
 
$address = JRequest::getVar('address', 'default value goes here', 'post','validation type','mask type');
</pre>
+
</source>
  
 
*JREQUEST_NOTRIM - prevents trimming of whitespace
 
*JREQUEST_NOTRIM - prevents trimming of whitespace
Line 79: Line 72:
 
*JREQUEST_ALLOWHTML - allows most HTML. If this is not passed in, HTML is stripped out by default.
 
*JREQUEST_ALLOWHTML - allows most HTML. If this is not passed in, HTML is stripped out by default.
  
== Definition ==
+
=== 'get' ===
The class JRequest is defined in the following location.
+
To recieve a whole array filtered. If you would want to get the post data, you can use this.
 
+
<source lang="php">JRequest::get( 'post' )</source>
libraries\joomla\environment\request.php
+
<nowiki>This returns the standard post array.  You can use it on a template page if needed, or in the models section if convenient, it returns the most recent post.
 
+
Methods of this object were not found in the Framework section where one would expect to find them. </nowiki>
The JRequest api page can be found here.
+
==See also==
 
+
* [http://api.joomla.org/Joomla-Framework/Environment/JRequest.html JRequest on api.joomla.org]
[[http://api.joomla.org/Joomla-Framework/Environment/JRequest.html]]
+
* [[JURI]]
 +
* [[JRoute]]
  
 
[[Category:Development]]
 
[[Category:Development]]

Revision as of 13:15, 10 January 2010

Replacement filing cabinet.png
This Namespace has been archived - Please Do Not Edit or Create Pages in this namespace. Pages contain information for a Joomla! version which is no longer supported. It exists only as a historical reference, will not be improved and its content may be incomplete.


When writing any web application, it is crucial that you filter input data before using it. Joomla! provides a set of filtering libraries to help you accomplish this.

Contents

Defined in

libraries\joomla\environment\request.php

Methods

'getVar'

To retrieve GET/POST request data, Joomla! uses the getVar method of the JRequest class (JRequest::getVar()).

Retrieving Data

If you have a form variable named 'address', you would want to use this code to get it:

$address = JRequest::getVar('address');

Unless other parameters are set, all HTML and trailing whitespace will be filtered out.

The DEFAULT Parameter

If you want to specify a default value in the event that 'address' is not in the request or is unset, use this code:

$address = JRequest::getVar('address', 'Address is empty');
echo $address;  // Address is empty

The SOURCE Parameter

Frequently, you will expect your variable to be found in a specific portion of the HTTP request (POST, GET, etc...). If this is the case, you should specify which portion; this will slightly increase your extension's security. If you expect 'address' to only be in POST, use this code to enforce that:

$address = JRequest::getVar('address', 'default value goes here', 'post');

The VARIABLE TYPE Parameter

The fourth parameter of getVar() can be used to specify certain filters to force validation of specific value types for the variable.

$address = JRequest::getVar('address', 'default value goes here', 'post','variable type');

Here is a list of types you can validate:

  • INT
  • INTEGER
  • FLOAT
  • DOUBLE
  • BOOL
  • BOOLEAN
  • WORD
  • ALNUM
  • CMD
  • BASE64
  • STRING
  • ARRAY
  • PATH
  • USERNAME

The FILTER MASK Parameter

Finally, there are some mask constants you can pass in as the fifth parameter that allow you to bypass portions of the filtering:

$address = JRequest::getVar('address', 'default value goes here', 'post','validation type','mask type');
  • JREQUEST_NOTRIM - prevents trimming of whitespace
  • JREQUEST_ALLOWRAW - bypasses filtering
  • JREQUEST_ALLOWHTML - allows most HTML. If this is not passed in, HTML is stripped out by default.

'get'

To recieve a whole array filtered. If you would want to get the post data, you can use this.

JRequest::get( 'post' )

This returns the standard post array. You can use it on a template page if needed, or in the models section if convenient, it returns the most recent post. Methods of this object were not found in the Framework section where one would expect to find them.

See also