使用 zend_form 从请求中删除未经验证的元素
我正在使用 zend_form 创建呈现的表单。尽管表单中指定了验证规则，但向响应中注入新元素也并非不可能。因此需要对 $this->_request->getParams() 进行更多过滤。
有没有办法在执行操作之前删除所有未经验证的输入？我知道我可以在处理响应之前手动 unset() 任何外星人，但我正在寻找更优雅的解决方案。
编辑：
我希望获取请求参数并使用 Zend_Db_Table_Abstract::insert($this->_request->getParams()) 将它们放入数据库中。这本来可以很好地工作，因为表单已经过验证，并且仅验证了请求中存在的表单元素。由于情况并非如此，默认情况下，我会在插入之前过滤掉元素。
I am using zend_form to create the form that is rendered. Although there are validation rules specified in the form, it is not impossible to inject new elements into the response. Thus more filtering of $this->_request->getParams() is required.
Is there a way to delete all unvalidated input before reaching the action? I am aware that I can unset() any alien manually before processing the response, but I am looking for a more elegant solution.
EDIT:
I am looking to grab the request parameters and put them into the database using Zend_Db_Table_Abstract::insert($this->_request->getParams()). This would have worked fine since the form is validated and only validated form elements where present in the request. Since that's not the case, by default, I'd have filter out the elements prior to doing the insert.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
只选取操作中所需的字段（在使用 Zend_Form 验证它们之后）并丢弃其余参数不是更容易吗？
除非您在请求中包含许多参数，否则这对我来说似乎是最安全的方式...您只会获得您实际期望的参数，而不会获得其他任何参数。
编辑：
如果您只需要使用 Zend_Form 获取有效值，
getValidValues()方法会有帮助吗？请参阅 http://framework.zend。 com/manual/en/zend.form.quickstart.html#zend.form.quickstart.validate。然后，您可以从请求中unset()不在此列表中的所有参数。我不知道是否有比这更优雅的方法。Wouldn't it be easier just to pick up the fields you need in the action (after validating them with Zend_Form), and discard the rest of the parameters?
Unless you have many parameters in the request, this looks like the most secure way to me... You'll only get the parameters you are actually expecting, and nothing else.
EDIT:
In case you need to get only the valid values using Zend_Form, would the
getValidValues()method help? See http://framework.zend.com/manual/en/zend.form.quickstart.html#zend.form.quickstart.validate. You can thenunset()all the parameters not in this list from the request. I don't know if there is a way of doing it more elegant than this.