Never trust the input you receive from someone else. You want your data to have perfect integrity, within the limits that you establish. If you write a routine that saves someone's address to your database, don't trust your routine to magically fix user error. Only you can make that happen.

Lets write some quick code to save those addresses:

So what happens if someone leaves the ZIP code out? What if they put "pr0nd00d" as their ZIP code? Do not trust your input. Some might argue that these checks should be done before this function. Well, what if your co-worker, Billy Bob, reuses this function? Now he has to do the checks too. And don't trust he'll do it, either. Billy Bob is a lazy man, and not too smart in the first place.

So let's define a function to make sure the ZIP code is right. After all, my zip code is not "I like cheese."

The validZipCode() function takes a zip code and does a regular expression match against it. If it $zip begins with 5 digits, with an optional dash and 4 digit extension, return 1. Else return 0. Now, l ets integrate it with our current function.

Now our current function requires a valid ZIP code. It won't accept a blank one, nor a non-USA one. (Note that our function doesn't simply require a non-blank string -- that would be A Bad Thing(tm).) If a ZIP isn't passed, our function returns a 0. But wait...we can reword the logic so that when valid ZipCode() returns a 0, an array or string can be returned with a more descriptive error.


<?php

If(!validZipCode($zip))
    push_array($errors,"Invalid zip code.");
If(!validStreetAddress($streetAddress))
    push_array($errors,"Invalid address.");

?>


Adding the validation functions is an exercise left to the user. Some things may not be economically or technologically feasible, as you cannot always afford to verify information beyond a certain point. For example, it would be too slow to confirm every bit of the input from the one hundred addresses per second you get. However, a simple check like the one outlined above, makes it MUCH harder to have data that doesn't make sense. After all, we know that valid U.S. ZIP codes are numeric and how long they can be, so why accept data that's obviously wrong?