How to filter form data efficiently?

[uzeruzer]

I'm a noob to CF and I need to figure out how to filter form data efficiently. I'm making a simple guestbook, but want to be able to apply a TRIM to each element, plus it would be nice if I could run each through a custom function to filter as well, to remove any nasty HTML characters and the like.

    Here is my form page

<cfif IsDefined("form.submit") AND IsDefined("form.comment") AND IsDefined("form.name") AND IsDefined("form.location")><!---these should be sent regardless if they are blank--->
     <cfif Trim(form.comment) NEQ "">
          <cfset form.comment = Trim(form.comment)>
          <cfif Trim(form.name) NEQ "">
               <cfset form.name = Trim(form.name)>
          <cfelse>
               <cfset form.name = "Anonymous">
          </cfif>
          <cfset form.location = Trim(form.location)>
          <!---leave it blank if empty---><!---THERE SHOULD BE AN EASIER WAY TO FILTER EACH FORM ELEMENT, FOR INSTANCE TO DO A TRIM ON ALL OF THEM---><!---
                    THIS DIDNT WORK
                    <cfparam name="form.name" default="Anonymous">
                    <cfparam name="form.location" default="">
                    --->
          <cfinvoke
          component="guestbook.cfc.db"
          method="insert_comment">
          <cfinvokeargument name="form_data" value="#form#"/>
          </cfinvoke>
     <cfelse>
          <cfset message="Comment is required!">
     </cfif>
</cfif>


<cfform method="post" name="guestbook">
<label>Name <cfinput type="text" name="name" size="50" maxlength="50"></label>
<label>Location <cfinput type="text" name="location" size="50" maxlength="50"></label>
<label>Comment <textarea name="comment" cols="65" rows="10" wrap="virtual"></textarea></label>
<button type="submit" name="submit" value="Submit">Submit</button>
</cfform>

     Here is my CFC

     <cfcomponent>
     <!--- INSERT COMMENT --->
     <cffunction name="insert_comment" access="public" returntype="void">
          <cfargument name="form_data" type="struct" required="yes">
          <cfquery datasource="guestbook">
               INSERT INTO comments
               (name, location, comment)
               VALUES
               ('#form_data.name#', '#form_data.location#', '#form_data.comment#')
          </cfquery>
     </cffunction>
</cfcomponent>

[BKBK]

<!--- THIS DIDNT WORK
<cfparam name="form.name" default="Anonymous">
<cfparam name="form.location" default=""> --->

That is as expected. Coldfusion will only run cfparam if the variable is undefined. However, when the form is submitted,  form.name and form.location are defined. So, cfparam wont run.

You can simplify the rest of your code as follows:

<cfif IsDefined("form.submit")><!--- one field is sufficient --->
    <!--- define the struct to be passed to the function --->
    <cfset data.comment = trim(form.comment)>
    <cfset data.name = trim(form.name)>
    <cfset data.location = trim(form.location)>
     <cfif comment NEQ "">        
          <cfif name EQ "">
               <cfset name = "Anonymous">
          </cfif>
          <cfinvoke
                  component="guestbook.cfc.db"
                  method="insert_comment">
                  <cfinvokeargument name="form_data" value="#data#"/>
          </cfinvoke>
     <cfelse>
          <cfset message="Comment is required!">
     </cfif>
</cfif>

<cfform method="post" name="guestbook">
<label>Name </label><cfinput type="text" name="name" size="50" maxlength="50">
<label>Location </label><cfinput type="text" name="location" size="50" maxlength="50">
<label>Comment </label><textarea name="comment" cols="65" rows="10" wrap="virtual"></textarea>
<cfinput type="submit" name="submit" value="Submit">
</cfform>