Form validation - security and input specification

Question

So I'm working on a register form and I have four fields: name, username, email and password. I pick up the values of these fields in jQuery and depending on if all the fields are filled, I pass them onto a PHP script via ajax. Is that safe for form validations? I was worried about data getting manipulated by the user.

Further on in the php script, I check if all the posted values have data in them, only then will I proceed onto doing some validations... The validations are the parts where I'm worried that it's not the best and there are many flaws with it.

$name = $_POST['name'];
$username = $_POST['username'];
$email = $_POST['email'];
$password = $_POST['password'];


if (!preg_match("/^[A-Za-z '-]+$/i", $name)) {

    $errors = "Please enter a valid name.";

} else if (!preg_match("/^[A-Za-z]+\s[A-Za-z]+$/", $name)) {

    $errors = "Please enter your first and last name.";

} else if (strlen($username) <= 3 || strlen($username) > 15) {

    $errors = "Please pick a username between 4 - 15 characters. Be creative.";

} else if (!preg_match("/^[A-Za-z][A-Za-z0-9_.-]{4,15}$/", $username)) {

    $errors = "Please pick an alphanumeric username between 4 - 15 characters.";

} else if (filter_var($email, FILTER_VALIDATE_EMAIL) === false) {

    $errors = "Please enter a valid email.";

} else if (strlen($username )< 6 || strlen($username) > 32) {

    $errors = "Your password must atleast be 6 characters.";

} else {

    echo "valid";

}

Are these validation steps secure? Are there any loop holes that the user can manipulate the data?

The requirements for the fields are as follows - which im not so sure i hit on the head with my code: - The username should have alphanumeric characters with underscores (optional) - the name should have BOTH the first name and the last name

Thank you.

Answer 1

I take it you're trying to protect yourself from XSS attacks, injection and general mallicious input. You're well on your way (but do have a look here, there are some interesting links at the bottom).

That said, I'd say your validation needs work on a couple of (crucial) points:

• Don't be too strict: /^[A-Za-z '-]+$/i for a name doesn't allow "pièrre joão", but it clearly is a name. Just match all unicode chars, and drop the i flag, or change [A-Za-z] to [a-z]. I'd suggest you using this code: $name = trim($name); preg_match('/^[\w \'-]+$/u', $name). read about the u modifier here
• Be consistent: You're applying 2 patterns to $name: /^[A-Za-z '-]+$/i and /^[A-Za-z]+\s[A-Za-z]+$/ This means that, the second time dashes and accents aren't allowed. That's not good, not good at all. If needs must, explode the $name on ' ' (a space), and apply the first pattern to each name individualy. Or work on the regex some more.
• /^[A-Za-z][A-Za-z0-9_.-]{4,15}$/: This doesn't allow a 4 char long username, but requers the username to be at least 5 chars long: [a-z] matches 1 char, [a-z0-9_.-]{4,15} followed by at least 4, at most 15 chars. Now that's not bad, but it's not what you want.
• Validate the right things: near the end, you do some checks on the password, but you're using the $username variable... typo?
• Don't limit the length of a password: strlen($username) > 32? Why? If the client wants to use a longer (and possibly stronger) password, let them do so...
  If you're going to do some checks on the password, at least to make sure that they're using chars, numbers and symbols. Not just "somealllowercasepass", but "S0m3@llw@kkyp@55"

Like I said above, you're missing out on some things, too:

• No where are you calling strip_tags to ensure any markup is being removed from input
• The password validation isn't applied to the correct variable, and should be improved, too
• Your error messages are waay too specific. That's a bad idea! If I had bad intentions, and tried to fill in the form, each time trying some XSS trickery, and you give me feedback as in: "username mustn't contain chars like <, >, /, \, #, %", I can move on and try to exploit the next input field, and make sure I fill in a valid username, until I find a field where you let your guard down...
  Keep your error messages general: "Not all input was correct/the expected format/met the requirements". That should be enough. But as DmitriZaitsev says: be careful not to alienate/offend the end-users, or your queste for safety might backfire (and leave you with no data to protect). A simple way of validating the email address and not restricting the username is to use the email address as username. If google and SO do it, why can't you?