Posted Sat, 03 Sep 2005
How many times in the recent past have you written a method and not performed some sort of validation on your input parameters (i.e., null check, range check, etc)? I ran across a pathetic example of this while browsing Clarkson's news site this morning... here's a screen shot from normal usage:

As you can see, the view.php script expects at least one parameter, "id". I had hopes that removing the parameter would do something cool, like show me a list of artcles to choose from, but I was sadly mistaken:

As you can see, the author of this script doesn't even bother to make sure a parameter is provided before using it! This is especially critical in web applications where your parameters are exposed to mangling by the users. Never trust that data is there; always check. Aside from the fact that it just provides a very unprofessional feel to your application to see a screen such as above, you never know what kind of security holes you may be opening yourself up to by not paying attention!
add to del.icio.us



