A Day in Paradise

Note: This was originally a comment on shiflett’s blog, but I’m reposting it here for my future reference.

In my recent article on string handling in International PHP Magazine, I had originally dedicated a whole section to the ctype library. However, the more I looked at it the less useful they became for anything more than just the most basic of validation.

The main problem with this library is the fact that it is not intended for handling strings. The C stands for Character, and the original functionality is to determine if a specific character is of the defined type.

In PHP we are trying to make it work with strings and the concept doesn’t carry over very well.

If you could add a parameter that would check the string for an occurance of that character type it could be much more powerful, because then we could do stuff like:

if (ctype_cntrl($_POST['username'], true)){
    die("Your username contains control characters");
}

The other problem with ctype (and string functions in general) is locale. By default on Unix systems, PHP will use the standard C locale which is [A-Za-z], so with a simple alnum check, plenty of people won’t be able to sign in.

All that to say that after all my research all the ctype library got was a brief mention, since IMO it really isn’t that useful.

The upside is that you can use POSIX named classes in your preg_* functions (AFAIK, this is undocumented), so the same simplistic example above can be done with:

if (preg_match('/[[:cntrl:]]/', $_POST['username'])){
    die("Your username contains control characters");
}

Now you’re not able to give the speed that ctype offers, but at least it’s much simpler than trying to work it all out yourself.

This entry was posted on Monday, December 20th, 2004 at 2:16 pm and is filed under PHP. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.