php script won't throw exception

Question

I'm trying to validate my php form using exception, but somehow it doesn't work. The exception is supposed to be thrown if the user enters in "nameg" any character which is not string and in the "amountg" anything which is not integer. Should Exceptions even be used in this case:

if(!empty($_POST['nameg']) && !empty($_POST['amountg']))
{
    $user="rootdummy";
    $pass="password";
    $db="practice";
    $nameg=$_POST['nameg'];
    $amountg=$_POST['amountg'];

    try{
        if(!is_int($amountg) || !is_string($nameg)){
            throw new Exception("This is the exception message!");
        }
    }
    catch (Exception $e){
        $e->getMessage();
    }

    mysql_connect('localhost',$user,$pass) or die("Connection Failed!, " . mysql_error());
    $query="INSERT INTO practable (name,given) VALUES('$nameg',$amountg) ON DUPLICATE KEY UPDATE name='$nameg', given=IFNULL(given + $amountg,$amountg)";
    mysql_select_db($db) or die("Couldn't connect to Database, " . mysql_error());
    mysql_query($query) or die("Couldn't execute query! ". mysql_error());

    mysql_close() or die("Couldn't disconnect!");
    include("dbclient.php");
    echo "<p style='font-weight:bold;text-align:center;'>Information Added!</p>";
}

Your code is vulnerable to SQL injection and mysql_* is softly deprecated. — Paul
– Paul, Commented Mar 24, 2012 at 14:07
Yes $_POST['amountg'] is the value that the user enters through the form. — tutak
– tutak, Commented Mar 24, 2012 at 14:15
Everything coming out of _POST/_GET/_REQUEST is a string, even if it is a "number". — Marc B
– Marc B, Commented Mar 24, 2012 at 14:28
@MarcB I think now i understand why it throws exceptions even if i pass it an integer... How would you validate this form? — tutak
– tutak, Commented Mar 24, 2012 at 14:35

Michael · Accepted Answer · 2012-03-24 14:47:09Z

3

Presumably you want to output the exception? Do:

echo $e->getMessage();

Edit: In response to your later comment regarding script ending, put the MySQL queries in the try block.

Edit 2: Changed validation in response to your comments.

if(!empty($_POST['nameg']) && !empty($_POST['amountg']))
{
    $user="rootdummy";
    $pass="password";
    $db="practice";
    $nameg=$_POST['nameg'];
    $amountg=$_POST['amountg'];

    try{

        if(!ctype_numeric($amountg) || !ctype_alpha($nameg)){
            throw new Exception("This is the exception message!");
        }

      mysql_connect('localhost',$user,$pass) or die("Connection Failed!, " . mysql_error());
      $query="INSERT INTO practable (name,given) VALUES('$nameg',$amountg) ON DUPLICATE KEY UPDATE name='$nameg', given=IFNULL(given + $amountg,$amountg)";
      mysql_select_db($db) or die("Couldn't connect to Database, " . mysql_error());
      mysql_query($query) or die("Couldn't execute query! ". mysql_error());

      mysql_close() or die("Couldn't disconnect!");
      include("dbclient.php");
      echo "<p style='font-weight:bold;text-align:center;'>Information Added!</p>";

    }
    catch (Exception $e){
        echo $e->getMessage();
    }
}

edited Mar 24, 2012 at 14:47

answered Mar 24, 2012 at 14:06

Michael

12.9k6 gold badges57 silver badges69 bronze badges

Sign up to request clarification or add additional context in comments.

7 Comments

tutak Over a year ago

Just modified the code and tried, it does work! BUT now it throws the exception even "nameg" contains string and "amountg"contains integer. Throws it everytime! Am i too noob for exceptions? :(

Michael Over a year ago

In the catch block, put var_dump($amountg) and var_dump($nameg) and show us the outputs.

tutak Over a year ago

This is what i get: This is the exception message!string(2) "45" string(7) "testone"

Michael Over a year ago

As you can see, they're both strings so is_int($amountg) fails. Try instead is_numeric($amountg) (allows decimals) or ctype_digit($amountg) (does not allow decimals)

Michael Over a year ago

Because it's still a string (just a string of numbers). Use ctype_alpha($nameg).

|

Martin. · Accepted Answer · 2012-03-24 14:06:56Z

1

It does, but you're doing nothing with your exception, except catching it.

Try

echo $e->getMessage()

answered Mar 24, 2012 at 14:06

Martin.

10.5k3 gold badges45 silver badges69 bronze badges

Comments

Paul · Accepted Answer · 2012-03-24 14:14:10Z

1

You are catching it and performing a statement that does virtually nothing.

$e->getMessage(); just gets it as a string and throws it away without echoing it.

Either echo it or rethrow or, if you just wanted to exit at that point, don't catch the exception at all (you can remove both the try and catch blocks).

edited Mar 24, 2012 at 14:14

answered Mar 24, 2012 at 14:05

Paul

6,9093 gold badges42 silver badges52 bronze badges

4 Comments

tutak Over a year ago

True, I just added that. However I want the script to break if the exception is thrown. I added break; in the catch block but it gives me an error: Fatal error: Cannot break/continue 1 level in c:\ Is the way I used exceptions with form validation correct or should if/else conditions be used like the initial checking to see if the form is empty?

Paul Over a year ago

I think you just want to throw, so I edited that in. Throwing without catching will cause the exception to bubble upwards till it is caught or it reaches any set_exception_handler.

tutak Over a year ago

Well I wanted something like this: try{} catch{echo "enter again please!";include("form.php");break;} something like which shows the form again with a message, throwing without catching the exception gives me an exception error.

Paul Over a year ago

You can do that, just don't include the break statement. When it gets to the end of the catch block the code will continue, or use return to return from the function.

Collectives™ on Stack Overflow

php script won't throw exception

3 Answers 3

7 Comments

Comments

4 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

3 Answers 3

7 Comments

Comments

4 Comments

Your Answer

Sign up or log in

Post as a guest

Related