Input validation for Mike

gistfile1.aw

<?php 

// validate our inputs
try {

  // check to ensure we are passed the correct parameters
  if ( empty($id) )
    throw new Exception('id not defined');
  if ( empty($uname) )
    throw new Exception('uname not defined');

  // check $id matches a numeric string of any length
  if (! preg_match( $id, '^[0-9]+$'))
    throw new Exception("Invalid id: $id");

  // check $uname matches an uppercase alpha-numeric string of any length
  if (! preg_match( $uname, '^[A-Z0-9]+$'))
    throw new Exception("Invalid uname: $uname");

} catch(Exception $e) {

  // Handle our Exceptions by logging an error and returning the default image
  // You could wrap the whole function in a try/catch and use the exception handler
  // to always generate the default image (what happens if the database returns no image?)
  error_log($e->getMessage());
  header('Content-Type: image/jpeg');
  readfile('default.jpg');

  exit;
}

?>