User form input sanitization

[teedoff]

I have two inputs for users to enter, what should always be a nueric string. This string gets processed and some mathmatical cals done to them, then the results are returned to the same page via cf div and bind attribute. Everything works if only numbers are entered. I have assumed a cfqueryparam with a reg ex could be used, but not having much luck.

Here is the form inputs:

<cfform id="bulbForm">
  <table align="center">
    <tr>
      <th>Lamp Voltage:</th>
      <td><cfinput name="lampVoltage" type="text"></td>
    </tr>
    <tr>
      <th>Socket Voltage:</th>
      <td><cfinput name="socketVoltage" type="text" onBlur=""></td>
    </tr>
    <br />
  </table>
</cfform>
<cfdiv bind="url:calcAction.cfm?lampVoltage={lampVoltage}&socketVoltage={socketVoltage}"
       id="dynaDiv">
</div>


and the processing code:

    <cfif url.lampVoltage NEQ "" AND url.socketVoltage NEQ "">
      <cfset lampVolts = REReplaceNoCase(url.lampVoltage, '[^a-z0-9]', ', 'all')>
      <cfset actualVolts = url.socketVoltage>
      <!--- Set Constants For Calculations --->
      <cfset lumens = 27500>
      <cfset life = 500>
      <cfset watts = 65>
      <cfset colorTemp = 2870>
      <!--- Perform Calculations --->
      <cfset actualLumens = ((actualVolts/lampVolts)^3.4)*lumens>
      <cfset lumenPercent = actualLumens/lumens*100>
      <cfset hours = ((lampVolts/actualVolts)^13)*life>
      <cfset hourPercent = hours/life*100>
      <cfset actualWatts = ((actualVolts/lampVolts)^1.3)*watts>
      <cfset wattPercent = actualWatts/watts*100>
      <cfset temperature = ((actualVolts/lampVolts)^.42)*colorTemp>
      <cfset tempReduction = temperature-colorTemp>

      <h2>Photo Lamp Characteristics Calculator</h2>
      <cfoutput>
        <table>
          <tr>
            <th colspan="2" align="center"><h3>You have a lamp rated at #url.lampVoltage# volts with a socket carrying #url.socketVoltage# actual volts.</h3></th>
          </tr>
          <br />
          <tr>
            <th width="338" align="center"><strong>#round(lumenPercent)#%</strong></th>
            <td width="470" align="left">Percent increase in Lumens/Candlepower/Light</td>
          </tr>
          <tr>
            <th align="center"><strong>#round(hourPercent)#%</strong></th>
            <td align="left">Percent increase in Rated Life</td>
          </tr>
          <br />
          <tr>
            <th align="center"><strong>#round(wattPercent)#%</strong></th>
            <td align="left">Percent of Wattage used.</td>
          </tr>
          <br />
          <tr>
            <th align="center"><strong>#round(tempReduction)#&deg;</strong></th>
            <td align="left">Change in Color Temperature.</td>
          </tr>
        </table>
      </cfoutput>
      <cfelse>
      <h3>Please enter  Lamp and Socket Voltage above to calculate differences, then click in this gray box. Your results will display here automatically.</h3>
</cfif>

I copied the regex from a site, but somethings wrong. Any help is greatly appreciated.

[teedoff]

I should have added the error is a CFML construct error, just not sure what the error is.

[arrgh]

What is the error message?

[teedoff]

Error retrieving markup for element dynaDiv : Invalid CFML construct found on line 3 at column 73. [Enable debugging by adding 'cfdebug' to your URL parameters to see more information]

Is the error I'm getting.

[arrgh]

Enable debugging by adding 'cfdebug' to your URL parameters to see more information

And when you did what it said, what was the real error message? Note, ajax debugging has to be enabled in the CF Admin too.

<cfset actualVolts = url.socketVoltage>

A couple observations
- you're only validating the 1st parameter, not all of them.
- even with the regex, you still need to validate the final value is a number. it could be an empty string which would fail when you tried to use math on it
- you have to guard against divide by zero exceptions

[teedoff]

Well I only added the first to test. When I added the first, it seems a syntax error is present because the color of all following code changed, which usually indicates a missing quote or comma or something. I'll check the ajaz debug info this evening when I get home. Thanks for the help.

[arrgh]

Oh well you are missing a closing single quote. I thought it was just a pasting error.

<cfset lampVolts = REReplaceNoCase(url.lampVoltage, '[^a-z0-9]', '(missing here), 'all')>

But you should use the debugger too. That's where all the juicy error messages are when using ajax features ;-)

[teedoff]

Ok that missing single quote fixes that problem. Maybe I should have explained my desired results better lol. What I'm wanting to do is strip anything BUT numbers from the input fields. Then if a user types in 120v, or 120volts, all characters except the numbers are stripped out before processing. Hope that makes better sense.

[arrgh]

Yeah, that's what I figured. But you'll still need additional validation to handle common math errors
(divide by zero, value is completely non-numeric, etc..)

[teedoff]

This seems to work fine:

<cfset lampVolts = REReplaceNoCase (url.lampVoltage, '[^0-9]', '', 'all')>
<cfset actualVolts = REReplaceNoCase (url.socketVoltage, '[^0-9]', '', 'all')>
<!--- Set Constants For Calculations --->
<cfset lumens = 27500>
<cfset life = 500>
<cfset watts = 65>
<cfset colorTemp = 2870>
<!--- Perform Calculations --->
<cfset actualLumens = ((actualVolts/lampVolts)^3.4)lumens>
&amp;amp;lt;cfset lumenPercent = actualLumens/lumens100>
<cfset hours = ((lampVolts/actualVolts)^13)life>
&amp;amp;lt;cfset hourPercent = hours/life100>
<cfset actualWatts = ((actualVolts/lampVolts)^1.3)watts>
&amp;amp;lt;cfset wattPercent = actualWatts/watts100>
<cfset temperature = ((actualVolts/lampVolts)^.42)*colorTemp>
<cfset tempReduction = temperature-colorTemp>

Now the form input will accept alpha numeric characters before and after numbers, but still only process the numeric inputs. Not sure what you mean about divide by zero values.

[arrgh]

Not sure what you mean about divide by zero values.

You're using the variables in a division operation. Dividing by zero throws an error. If the final value is 0 the code will blow up. Likewise, if the result of your regex is an empty string, like if the user entered nothing or all letters.

[teedoff]

lol Never thought someone might enter a 0 as a value. hmm ok need to do something different then. Thanks!

[teedoff]

Well I'm trying to find some help on this, but everything I find discusses SQL division by zero errors. Not sure that's what I need since this is just a user input variable. Know any good links for this? Thanks.

[arrgh]

Handling is basically the same in any language. Use an if/else to do the division when the value isn't 0. Otherwise, do something else like return 0.

[simplico]

Ever thought to use <cfinput validate="numeric" ...>?

[arrgh]

That would certainly improve the UX. But like always, you've still got to back it up with server side validation.