Join 244,308 PHP Programmers for FREE! Get instant access to thousands of PHP experts, tutorials, code snippets, and more! There are 807 people online right now. Registration is fast and FREE... Join Now!
I need to allow users to only be able to submit numbers into a text field and if they submit anything else it needs to strip all other characters be it letters or symbols. If someone could help me with this it would be very much apprecaited...because as of right now a user can enter + signs on both side of a number like so, +10000+, and it will submit it and send that amount of money even if the user does not have that much.
CODE
<?php include 'header.php';
if($_POST['sendmoney'] != ""){ $money_person = new User($_POST['theirid']);
$newmoney = $money_person->money + $_POST['amount']; $result = mysql_query("UPDATE `grpgusers` SET `money` = '".$newmoney."' WHERE `id`='".$_POST['theirid']."'"); echo "You have successfully transferred $".$_POST['amount']." to ".$money_person->formattedname."."; Send_Event($user_points->id, "You have been sent $".$_POST['amount']." from ".$user_class->formattedname); } else { echo "You don't have enough money to do that!"; } } ?>
I would change the second and third lines from this:
CODE
for($i = 0; $i < $length; $i++){ $numbers = '';
to this:
CODE
$numbers = ''; for($i = 0; $i < $length; $i++){
As $numbers was being reset to '' in every instance of the loop.
*END EDIT*
To explain what grim's code does, it loops through the amount entered, checking each number / letter.
$temp is the ASCII value of the individual character of each number/letter in amount. e.g.
4734556 $temp on the first loop is the ASCII value of 4, 7 on the second loop, 3 on the third loop, 4 on the 4th etc.
So, if $temp is between 48 and 57, it is concidered a number (I'm assuming that 48 - 57 is the ASCII range of 0 - 9, don't know the ASCII values of the top of my head)
If it is in this range then it is a number, so it is appended to the variable $numbers.
So, if you where to enter this as the amount:
54asd65asd45
You would get 546545 as the $numbers value.
All in all a nice function that i think I'll be adding to my library, thanks grim
This post has been edited by pemcconnell: 1 Oct, 2008 - 04:52 AM
I am not quite sure how i should be implementing this into my code..I am very new to PHP. Can I also see an example of how I would only allow numbers using ereg() statements? And also how to replace anything eneteredinto the field such as +123123+ to remove the + and + fromt he outsides and only keep the 123123?
You could use that on the front end of the site, to limit what can be entered into the form. Then after the form is submitted you could use PHP to double check that the string only contains numbers using any of the methods that have been given to you.
It's very important to double check with PHP, as Javascript can easily be beat.
I would add a test at the end to see if $numbers == $_POST['amount']. That's because if somebody enters something like "99 Main Street", this will result in $numbers = 99. It's likely that the user in such a case will have typed the information in the wrong field, and the intended number for this field is either missing completely or entered elsewhere.
If you confirm that $numbers == $_POST['amount'] then at least you know that they meant to enter a number.
Seems a bit simpler. If you can avoid regular expressions, you should.
This actually brings up a good point. When looking to complete a specific tasks, check the documentation on php.net and see if there's a prebuilt function. Often, there are already solutions for what you're trying to find.
Thank you very much penn for that explantion. It helped me alot I will try to use that right now and tell you how it works for me. Thankyou everyone else as well for the help with this bug.
One last example if you wanted to use regex. You can use the preg_replace() function to replace the characters, without the need to loop through each one. I actually kinda dig this one because it's only three lines.
php
$number = $_POST['amount']; $pattern = '/[^0-9]/'; // This means to search for anything that is not a number $string = preg_replace($pattern, '', $number); // Replaces anything that matches the pattern with an empty string
// String has now been stripped of all non numeric characters
Finally, you could use this all in a function like so:
// Call the function like this $string = '9034klfa9032jklfau2hhf234'; $string = strip_to_numbers_only($string);
Hope you can add that to your functions library. I'm gonna go submit it to the code snippets now.
Adios
*EDIT* I made a mistake and had preg_replace($pattern, '', $string). Should be preg_replace($pattern, '', $number) if used with the first code sample. The second sample is correct. *END EDIT*
This post has been edited by akozlik: 1 Oct, 2008 - 06:37 AM
$newmoney = strip_to_numbers_only($user_class->money - $_POST['amount']); $result = mysql_query("UPDATE `grpgusers` SET `money` = '".$newmoney."' WHERE `id`='".$_SESSION['id']."'");
$newmoney = strip_to_numbers_only($money_person->money + $_POST['amount']); $result = mysql_query("UPDATE `grpgusers` SET `money` = '".$newmoney."' WHERE `id`='".$_POST['theirid']."'"); echo "You have successfully transferred $".$_POST['amount']." to ".$money_person->formattedname."."; Send_Event($user_points->id, "You have been sent $".$_POST['amount']." from ".$user_class->formattedname); } else { echo "You don't have enough money to do that!"; } } ?>
I have fixed the problem where it puts you in the negatives... but you are still able to send using the +100+ and all it does is do the absolute value of how much you would be in the negatives..
@pem: thx for the revision lol I can't believe I made that mistake, then again I was pretty sleepy.
@akozlik: I did indeed forget about the is_numeric function. In regards to the regex I usually avoid using them if I can come up with a way to do it using simple string operations. I would imagine those are faster than regex, but testing it would be the only way to be sure.
Yeah I totally understand that regex is not the way to go. Initially I thought so too with this problem. However, the regex method is much more efficient. It simply runs the preg_replace() function once to replace all the non-numeric characters.
The loop method requires that the ord() function, substr() function and chr() functions all be run $length number of times. If you have a string of 10 characters and you want to replace all non-numeric characters using the loop method, each one of those functions would be executed 10 times. That totals out to 30 function calls by the time the loop's over!
It took a minute to find the preg_replace() function, but in this situation it's definitely the more efficient way to go.
As you can see, for smaller strings the amount of difference isn't too bad. The preg_replace() method was only about twice as fast as the loop method. However, as the string lengths got greater, the amount of difference could really be seen. The preg_replace method took 1.6 seconds to strip an 88 character string. The loop method took 11.9!
That's the point I was making. All those functions within the loop are executed once per iteration. Doing preg_replace() takes care of it all at once.
Finally, I'm not posting this as a 'my code is better than your code' sort of thing. You had mentioned benchmarking and I had some spare time.
Take care!
This post has been edited by akozlik: 1 Oct, 2008 - 12:25 PM
*EDIT* I removed this previous post because I was full of crap and wrote my benchmarking wrong. I retested and the regex was way faster. Stick with that
This post has been edited by akozlik: 1 Oct, 2008 - 12:19 PM
@akoz right now it if a user has $100 they can enter +1000+ into the sendmoney field. it will send $1000 to the user your sending to and then subtract $1000 from you leaving you with -$900. it needs to strip everything except the numbers so that if you dont have the correct amount of money than it should say "not enough money" which it does if you dont use the +'s