验证输入的用户数据
这是一个一般性问题，但我做了一个桌面应用程序。
例如，我是否应该检查超过 50 个字符的名字，或者这是一个品味问题？
或者我应该检查 > 50 个字符，因为用户可以用 10000000 个字符淹没我的数据库？
编辑：
似乎我让球滚动...我应该说，我的桌面应用程序中的名字/姓氏来自老师输入的学生...
所以 50 个字符足以输入“Michael”和“Kramer”don你不觉得吗？ ;-)
This is a general question but I do a desktop application.
Should I check for example the firstname exceeding 50 chars or is this a matter of taste?
Or should I check for > 50 chars because the user could flood my database with 10000000 chars ?
EDIT:
Seems I made the ball rolling... I should have said, that the firstname/lastname in my desktop app are from pupils a teacher enters...
so 50 chars is more than enough entering "Michael" and "Kramer" don`t you think? ;-)
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（4）
您应该始终验证您的输入数据。如果不出意外，我假设您的数据库字段是一个设置字段，因此您应该阻止用户输入更长的字符串，因为您无法存储它们，因此当数据库插入失败时，太长的名称可能会引发某种错误。
You should always validate your input data. If nothing else, I assume that your database field is a set field so you should the stop the user from entering longer strings since you can't store them so too long names would probably throw an error of some kind when the DB insert fails.
世界的方式多种多样，虽然 50 个字符对于 WASP 的名字来说似乎足够了，但我不会冒险宣称世界上没有人没有更长的名字。相反，我会确保我的应用程序在任何地方都不会使用固定长度缓冲区，因此，如果有人输入了 10,000,000 个字符长的名字，所发生的情况就是它会比平常多使用几个字节。
The ways of the world are many and varied, and while 50 characters seems like plenty for a WASP first name, I wouldn't go out on a limb and declare that there is nobody anywhere who doesn't have a longer one. Instead, I would make sure that my application never uses fixed length buffers ANYWHERE, so if somebody entered a first name that was 10,000,000 characters long, all that would happen is it would use a few more bytes than usual.
另请记住，虽然大多数人的单个姓名不会超过 50 个字符，但他们的姓名可能会很多。例如，阿道夫·布莱恩 (Adolph Blaine) 先生、查尔斯·戴维·厄尔 (Frederick Gerald Hubert Irvin)、约翰·肯尼斯·劳埃德 (John Kenneth Lloyd Martin) 尼禄·奥利弗 (Nero Oliver)、保罗·昆西·兰道夫·谢尔曼 (Thomas Uncas) 先生、维克多·威廉·薛西斯 (William Xerxes) 先生、扬西·宙斯 (Yancy Zeus) 沃尔夫施莱格尔斯坦豪森伯格多夫 (Wolfeschlegelsteinhausenbergerdorft Senior)。不让用户输入他们的全名几乎是一件非常糟糕的事情。
Also keep in mind that while most people don't have any single name much longer than 50 characters, they might have exceedingly many names. Consider, for example, Mr. Adolph Blaine Charles David Earl Frederick Gerald Hubert Irvin John Kenneth Lloyd Martin Nero Oliver Paul Quincy Randolph Sherman Thomas Uncas Victor William Xerxes Yancy Zeus Wolfeschlegelsteinhausenbergerdorft Senior. Not letting users enter their full name is an almost entirely terrible thing to do.
多级验证策略通常是合适的。在用户级别，不允许任何以后会导致错误的事情。但是，如果您依赖 JavaScript 验证，请注意它很容易被绕过。您的业务和/或数据层还应该在存储到数据库之前进行验证。如果您将数据发送到服务，情况也是如此。
客户端验证可用性。服务器端验证可靠性和完整性。
A multilevel validation strategy is usually appropriate.At the user level, don't allow anything that will cause errors later on. However, if you're relying on JavaScript validation, be aware that it can be bypassed easily. Your business and/or data layers should also validate before storing to the database. The same is true if you're sending data off to a service.
Client-side validation for usability. Server-side validation for reliability and integrity.