When do you trust the data / variables
- by Wizzard
We all know that all user data, GET/POST/Cookie etc etc needs to be validated for security.
But when do you stop, once it's converted into a local variable?
eg
if (isValidxxx($_GET['foo']) == false) {
throw InvalidArgumentException('Please enter a valid foo!');
}
$foo = $_GET['foo'];
fooProcessor($foo);
function fooProcessor($foo) {
if (isValidxxx($foo) == false) {
throw Invalid......
}
//other stuff
}
To me thats over the top.
But what if you load the value from the database...
I hope I make sense :)
