As part of a custom module I input data taken from a user form to a custom table in the database. This is the code that I use to save the data:

            'message'=>$post['comment'] )

Does this need validation on the input variables to avoid potential sql injection or is this done automatically via the setData() and/or save() function.

If it does need some kind of validation what should it get?

In the contacts_index_post section I see this:

if (!Zend_Validate::is(trim($post['name']) , 'NotEmpty')) {
                $error = true;

if (!Zend_Validate::is(trim($post['comment']) , 'NotEmpty')) {
                $error = true;

    if (!Zend_Validate::is(trim($post['email']), 'EmailAddress')) {
                $error = true;

Which I assume would work for all of the input variables except telephone variable. If I'm correct about those three validation checks all I need is some advice on validating the telephone field.

1 Answer 1


There are plenty of reasons to do validation on this in terms of making sure the exact data type you want is being inserted. In terms of keeping everything safe however I don't think it is so necessary to add anything extra here.

Recently I had a need to insert raw xml into a custom table much like the table described in the question. From trying to do this I was able to see that magento core provides some safety checks. The end result being I wasn't able to just insert it as you might with regular text.

This is far from being a great answer but as it's the only one so it will have to do. I asked the question and never really came to an exact conclusion so I thought it worth writing what I know now.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.