Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:95090
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 74.125.82.52 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <62f3799e-6df8-fe46-40f7-86c99e80992c@lsces.co.uk>
References: <10fbcb03-5de8-4d9a-da1c-7e2bf77937cb@lsces.co.uk>
 <CAGa2bXZQtWpLGz4btOZ_+hYZrbkOEbBg9V2MvTHRMC6J1qU4OQ@mail.gmail.com>
 <d988b027-d9b8-cf08-9a3f-c5ae37eaa60c@lsces.co.uk> <9f76a201-7423-51d3-96df-d14a1f38b843@gmail.com>
 <f357002a-f138-4e65-f3a9-2c709a32ac92@lsces.co.uk> <7b2581b5-c75d-cc72-745f-a58cded6dfd9@gmail.com>
 <CAEU6NActcL4vN-YMT=ggrN2jtciRKg89w6OGRxuw7gbZ++0qmw@mail.gmail.com> <62f3799e-6df8-fe46-40f7-86c99e80992c@lsces.co.uk>
Date: Fri, 12 Aug 2016 13:09:39 +0200
Message-ID: <CAEU6NAdwrk+4KEAEmPCXBMvDRCPvtsdQM8-SyC6mGmCLHsHwnA@mail.gmail.com>
To: Lester Caine <lester@lsces.co.uk>
Cc: PHP internals <internals@lists.php.net>
Content-Type: multipart/alternative; boundary=001a1148e4346370480539ddec68
Subject: Re: [PHP-DEV] Simple variable handling.
From: peter.e.lind@gmail.com (Peter Lind)

--001a1148e4346370480539ddec68
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

On 12 August 2016 at 13:01, Lester Caine <lester@lsces.co.uk> wrote:

> On 12/08/16 11:01, Peter Lind wrote:
> > On 12 August 2016 at 11:54, Rowan Collins <rowan.collins@gmail.com>
> wrote:
> >
> >> On 12/08/2016 10:21, Lester Caine wrote:
> >>
> >>> Many of my systems run on secure intra-nets and much of the 'safety
> >>> concerns' that have been brought up recently as 'essential' simply
> don't
> >>> apply.
> >>
> >> There's always rogue employees / students / visitors with temporary
> >> access... But yes, IF you trust your users 100% to be non-malicious,
> >> non-curious, and uninfected, THEN you can trust your user input. :)
> >>
> > You forgot non-clumsy. Typos also happen and can have problematic
> results.
> >
> > You cannot trust user input. End of discussion.
>
> That someone puts in Joens rather than Jones is a fact of life, and will
> result in records that can't be matched. But a UK formatted date
> validated in the browser makes checking it's in a valid range easier in
> the PHP end. It's simply a matter of just what you can test and where,
> and if needs be the system keeps track of who is making mistakes in data
> entry and their supervisor deals with them. THAT is a report my CMS
> systems have had from day one :)


And if all typos were switching 'e' and 'n', what a wonderful world it
would be. That is not the case though - it's possible to accidentally enter
" and > too.



> But if they have stolen someone else=E2=80=99s
> access card then all bets are off. But there is no 'delete' function on
> the data so all changes are recorded.
>
>
 No, all bets are not off. That's the whole point of defense in depth.


--=20
CV: careers.stackoverflow.com/peterlind
LinkedIn: plind
Twitter: kafe15

--001a1148e4346370480539ddec68--