Question

Hi I am trying to validate some user input and I’m not sure what is the correct way to go about it.

I want to validate first name and last name fields for a user creation form. I am using PHP with the Zend framework so I will be writing a validator. After doing some research I think I should really be allowing all UTF8 characters, with no spaces at beginning or end. I’m not sure on the regex but I can find that out later, I will most likely be using php’s preg_match.

I’m storing these details in OpenLDAP using the sn field for surname and the givenName for firstname. How should I be restricting the names? Is there a limit to the length in OpenLDAP, do I need to check the characters it accepts or does it accept all characters?

Should I even validate the first name and last name or should I just let the user input what they want?

I am using a separate field for username which will consist of “text.text”, text being A-Za-z chars.

I’m not posting code as I just a need a bit of guidance, not really sure whats the best practice here.

Answer 1

Validating names is a bad idea. There are no universal rules for what is allowed in a name, especially when you want to allow non-western text as well.

This presents a challenge when it comes to LDAP, since there is no guarantee that the directory will understand the charset of the user input. There is an easy solution to this though: base64_encode() the values before storing them in LDAP, and base64_decode() them on the way out.