Forums

Hi,

Wow. ChronoForms V4 is absolutely amazing. Great job people. We're going to switch out all existing forms to use ChronoForms. It doesn't get any more intuitive than this.

I have one area of concern. How do we stop people from using html or js or any type of coding within the TextArea boxes on our forms? I've combed through the forums and have the older version of the CF 3.1 book, but I don't know exactly what to use or how to apply it.

I know we need to use Server Side Validation in the first position in the OnSubmit event. But I'm lost after that.

Can you combine JS regex validation checking and server side regex validation on the same labels/fields? Or do we have to pick one or the other for that label/field?

We would like to do JS regex validation on the simple fields... Name, Email, Phone and then Server Side regex validation on the textarea boxes.

Just starting to wrap my mind around regular expressions in general. How it's described in the 3.1 CF book helps when it come to the differnce between "Alpha, Alphanumeric, and Digits". What we don't get is what are "@" "<>:" "~" "/\[]{}()&^%$#!" characters considered?

By the way... Thank you very much for the YouTube vids GreyHead. Some advance validation vids would have been the icing on the cake. Donations/licenses will be forth coming for each site we use ChronoForms on. Spot on developers.

Thanks for your time.
JBanks

Hi JBanks,

Client side validation (with JavaScript) and Server-side validation (with PHP) really do two quite different things.

Think of client side validation as being there to help the user fill in the form correctly - it is easily bypassed by turning off JavaScript so provided no security except against accidental errors.

Serverside validation is there to (a) double-check that you have the correct data formats and (b) to protect your site against a malicious submission.

You can add any PHP you like to the Server-side validtion box and it can either (a) mark an error and then re-display the form or (b) sanitise the data before the form is processed.

Just what code you need depends on your form.

The Joomla! JRequest methods provide some simple filters e.g.:

$form->data['input_name'] = JRequest::getInt('input_name', 999, 'post');

would only pass integer values for 'input_name' and would set a default value of 999.

The JRequest methods are based on the PHP VALIDATE and SANITIZE filters and you should refer to the PHP manual for more info on those and on how to use them for more extended checking.

To strip HTML the JRequest::getString() method or the equivalent PHP FILTER_SANITIZE_STRING

Bob