Make = possible in hotel names.

[timpegel]

Hi RAGE,



I'd like to make it possible that you can register with a username that includes = or - or . in the name. But when I use those, it'll block the register cause it's a unvalid username. How can I make those valid, so that users can make a name like for example -test. ?

 

[joepvand]

Im no expert but this protects you from SQLI Injection right?

 

[timpegel]

I don't really know. For me it's just that users can use the = or - in their usernames.

 

[streamhotel]

Im no expert but this protects you from SQLI Injection right?

It's not a issue if you use prepared statements. I'm very sure it's possible to use things like = in your username. I assume you'll need to edit the username validator. I don't know which CMS you're using?

 

[Keiz]

It obviously depends on what CMS you are.

 

[timpegel]

I'm using revcms. ( some kind of pear edit, I made it exploit-less. I don't know exactly where it came from but it's revcms.)



Somebody?

 

[Keiz]

\app\class.users.php:25

if(!preg_match("/^([A-Za-z]){3,15}-([A-Za-z]){3,15}$/", $username))

EDIT: Thats my RP regex, use something like

/^([A-Za-z0-9=-=.-.]){3,15}$/

 

[timpegel]

Thankyou @Keiz



Hmm, pretty sure that must be it. But how can I use this? There's no line for that.

final public function validName($username)         {        if(strlen($username) <= 25 && ctype_alnum($username))                  {                          return true;                  }                                    return false;         }

Do I need to delete the if <= 25 line? Or just paste the code under it.

 

[Keiz]

final public function validName($username)  
{
        return preg_match("/^([A-Za-z0-9=-=.-.]){3,15}$/", $username);
}

 

[timpegel]

Thanks ! Keiz