[alyis]

I need to allow users to only be able to submit numbers into a text field and if they submit anything else it needs to strip all other characters be it letters or symbols. If someone could help me with this it would be very much apprecaited...because as of right now a user can enter + signs on both side of a number like so, +10000+, and it will submit it and send that amount of money even if the user does not have that much.

<?php
include 'header.php';

if($_POST['sendmoney'] != ""){
  $money_person = new User($_POST['theirid']);

  if($user_class->money >= $_POST['amount'] && $_POST['amount'] > 0 && $user_class->id != $money_person->id){
	$newmoney = $user_class->money - $_POST['amount'];
	$result = mysql_query("UPDATE `grpgusers` SET `money` = '".$newmoney."' WHERE `id`='".$_SESSION['id']."'");

	$newmoney = $money_person->money + $_POST['amount'];
	$result = mysql_query("UPDATE `grpgusers` SET `money` = '".$newmoney."' WHERE `id`='".$_POST['theirid']."'");
	echo "You have successfully transferred $".$_POST['amount']." to ".$money_person->formattedname.".";
	Send_Event($user_points->id, "You have been sent $".$_POST['amount']." from ".$user_class->formattedname);
  } else {
	echo "You don't have enough money to do that!";
  }
}
?>

<div class="content"><u>Send Money</u><br>
<form name='login' method='post' action='sendmoney.php'>
  <p>&nbsp;</p>
  <table border='0' cellpadding='0' cellspacing='0'>
	<tr>
	  <td width='35%' height='27'>Amount Of Money</td>
	  <td width='65%'>
		<input name='amount' type='text' size='22'>
		</td>
	</tr>
		<tr>
	  <td width='35%' height='27'>User ID</td>
	  <td width='65%'>
		<input name='theirid' type='text' size='22' value='<? echo $_GET['person'] ?>'>
		</td>
	</tr>
	<tr>
	  <td>&nbsp;</td>
	  <td>
		<input type='submit' name='sendmoney' value='Send Money'>
		</td>
	</tr>
  </table>
</form>
</div>


<?php
include 'footer.php';
?>

[grimpirate]

$length = strlen($_POST['amount']);
for($i = 0; $i < $length; $i++){
$numbers = '';
$temp = ord(substr($_POST['amount'], $i, 1));
if($temp > 47 && $temp < 58)
$numbers .= chr($temp);
}
if(strlen($numbers) == 0) $numbers = 0;

This post has been edited by grimpirate: 30 September 2008 - 09:47 PM

[alyis]

Could you please explain your as to help me learn what I need to do....

[pemcconnell]

*EDIT*

I would change the second and third lines from this:

for($i = 0; $i < $length; $i++){
$numbers = '';

to this:

$numbers = '';
for($i = 0; $i < $length; $i++){

As $numbers was being reset to '' in every instance of the loop.

*END EDIT*

To explain what grim's code does, it loops through the amount entered, checking each number / letter.

$temp is the ASCII value of the individual character of each number/letter in amount. e.g.

4734556
$temp on the first loop is the ASCII value of 4, 7 on the second loop, 3 on the third loop, 4 on the 4th etc.

So, if $temp is between 48 and 57, it is concidered a number (I'm assuming that 48 - 57 is the ASCII range of 0 - 9, don't know the ASCII values of the top of my head)

If it is in this range then it is a number, so it is appended to the variable $numbers.

So, if you where to enter this as the amount:

54asd65asd45

You would get 546545 as the $numbers value.

All in all a nice function that i think I'll be adding to my library, thanks grim

This post has been edited by pemcconnell: 01 October 2008 - 05:52 AM

[alyis]

Thankyou pem and grim. This helps me alot with my game. IF anyone else has any other ways of doing this feel free to share them.

This post has been edited by alyis: 01 October 2008 - 04:53 AM

[pemcconnell]

I added grims code into a function with the tiny change i mentioned in my last post:

function getNumbersOnly($value){
	$numbers = '';
	for($i = 0; $i < strlen($value); $i++){
		$temp = ord(substr($value, $i, 1));
		if($temp > 47 && $temp < 58){
			$numbers .= chr($temp);
		}
	}
	return $numbers;
}

Full credit to grimpirate for the function.

This post has been edited by pemcconnell: 01 October 2008 - 06:22 AM

[alyis]

I am not quite sure how i should be implementing this into my code..I am very new to PHP. Can I also see an example of how I would only allow numbers using ereg() statements? And also how to replace anything eneteredinto the field such as +123123+ to remove the + and + fromt he outsides and only keep the 123123?

[pemcconnell]

Here is an example of the code:

function getNumbersOnly($value){
	$numbers = '';
	for($i = 0; $i < strlen($value); $i++){
		$temp = ord(substr($value, $i, 1));
		if($temp > 47 && $temp < 58){
			$numbers .= chr($temp);
		}
	}
	return $numbers;
}

$amount = getNumbersOnly($_POST['amount']);

?>

So if the user has entered +123456+ into the 'amount' field and posted the form, this line:

$amount = getNumbersOnly($_POST['amount']);

would strip any non-numbers from the data, meaning the code would read:

$amount = 123456;

*Again, all credit should go to grim for that

To use regular expressions to validate if a character is in the string, you could use:

$text = "mixedcharacters012345&../@";



if (ereg('[^A-Za-z0-9]', $text)) {

  echo "This contains characters other than just numbers";

}

else {

  echo "This contains only numbers";	

}

Taken from this site

[akozlik]

Here's some Javascript that you can include for your form:

How Can I Use Javascript to Allow Only Numbers to be Entered in a Textbox?

Wow, that's a long title.

You could use that on the front end of the site, to limit what can be entered into the form. Then after the form is submitted you could use PHP to double check that the string only contains numbers using any of the methods that have been given to you.

It's very important to double check with PHP, as Javascript can easily be beat.

Good luck!

[CTphpnwb]

grimpirate, on 30 Sep, 2008 - 09:46 PM, said:

$length = strlen($_POST['amount']);
for($i = 0; $i < $length; $i++){
$numbers = '';
$temp = ord(substr($_POST['amount'], $i, 1));
if($temp > 47 && $temp < 58)
$numbers .= chr($temp);
}
if(strlen($numbers) == 0) $numbers = 0;

I would add a test at the end to see if $numbers == $_POST['amount']. That's because if somebody enters something like "99 Main Street", this will result in $numbers = 99. It's likely that the user in such a case will have typed the information in the wrong field, and the intended number for this field is either missing completely or entered elsewhere.

If you confirm that $numbers == $_POST['amount'] then at least you know that they meant to enter a number.

[akozlik]

Has everybody forgotten about the built in function is_numeric()?

<?php
$number = $_POST['amount'];
$length = strlen($number);
for ($i=0; $i<$length; $i++)
{
    if ( !is_numeric($number[$i]) ) $number[$i] = '';
}
?>

Seems a bit simpler. If you can avoid regular expressions, you should.

This actually brings up a good point. When looking to complete a specific tasks, check the documentation on php.net and see if there's a prebuilt function. Often, there are already solutions for what you're trying to find.

Here's where the function description is. Check the left side column for a list of other is_* functions.

Hope that helps.

This post has been edited by akozlik: 01 October 2008 - 06:42 AM

[alyis]

Thank you very much penn for that explantion. It helped me alot I will try to use that right now and tell you how it works for me. Thankyou everyone else as well for the help with this bug.

[akozlik]

One last example if you wanted to use regex. You can use the preg_replace() function to replace the characters, without the need to loop through each one. I actually kinda dig this one because it's only three lines.

$number = $_POST['amount'];
$pattern = '/[^0-9]/'; // This means to search for anything that is not a number
$string = preg_replace($pattern, '', $number); // Replaces anything that matches the pattern with an empty string

// String has now been stripped of all non numeric characters

Finally, you could use this all in a function like so:

function strip_to_numbers_only($string)
{
     $pattern = '/[^0-9]/';
     return preg_replace($pattern, '', $string);
}

// Call the function like this
$string = '9034klfa9032jklfau2hhf234';
$string = strip_to_numbers_only($string);

Hope you can add that to your functions library. I'm gonna go submit it to the code snippets now.

Adios

*EDIT*
I made a mistake and had preg_replace($pattern, '', $string). Should be preg_replace($pattern, '', $number) if used with the first code sample. The second sample is correct.
*END EDIT*

This post has been edited by akozlik: 01 October 2008 - 07:37 AM

[alyis]

<?php
include 'header.php';

if($_POST['sendmoney'] != ""){
  $money_person = new User($_POST['theirid']);
  
   if($user_class->money >= $_POST['amount'] && $_POST['amount'] > 0 && $user_class->id != $money_person->id){
	
	function strip_to_numbers_only($string)  
	{  
		 $pattern = '/[^0-9]/';  
		 return preg_replace($pattern, '', $string);  
	} 
   
	$newmoney = strip_to_numbers_only($user_class->money - $_POST['amount']);
	$result = mysql_query("UPDATE `grpgusers` SET `money` = '".$newmoney."' WHERE `id`='".$_SESSION['id']."'");

	$newmoney = strip_to_numbers_only($money_person->money + $_POST['amount']);
	$result = mysql_query("UPDATE `grpgusers` SET `money` = '".$newmoney."' WHERE `id`='".$_POST['theirid']."'");
	echo "You have successfully transferred $".$_POST['amount']." to ".$money_person->formattedname.".";
	Send_Event($user_points->id, "You have been sent $".$_POST['amount']." from ".$user_class->formattedname);
  } else {
	echo "You don't have enough money to do that!";
  }
}
?>

I have fixed the problem where it puts you in the negatives... but you are still able to send using the +100+ and all it does is do the absolute value of how much you would be in the negatives..

[akozlik]

I'm sorry, I didn't quite understand that. Was there another problem popping up?