security - What is the most secure way to handle invalid input in a Zend application? -

i have application user arrives @ page link containing id value (e.g.: /students/view/42). in code, use zend_filter_input, this:

$input = new zend_filter_input(array(), array(     'id' => new zend_validate_db_recordexists(array (         'table' => 'students',         'field' => 'id'      ) ), $this->_request->getparams()); if (!$input->isvalid()) {     // ??? } 

i don't think there's earth-shattering going on point. however, unclear if value id invalid.

in book zend framework: beginner's guide, vikram vaswani has user throw exception (zend_controller_action_exception('page not found', 404)). best way go handling this, , if not, other options available?

you should redirect user page 404 error description (you should use errorcontroller exception messages rendering) or specific page message such student not exist.

just throw exception , render error page in errorcontroller.

you can this:

 $this->getresponse()->sethttpresponsecode(404); 

or

throw new zend_controller_action_exception('this page not exist', 404); 

the typical errorcontroller class following:

class errorcontroller extends zend_controller_action {     public function erroraction()     {         $errors = $this->_getparam('error_handler');          switch ($errors->type) {             case zend_controller_plugin_errorhandler::exception_no_route:             case zend_controller_plugin_errorhandler::exception_no_controller:             case zend_controller_plugin_errorhandler::exception_no_action:                 // 404 error -- controller or action not found                 $this->getresponse()                      ->setrawheader('http/1.1 404 not found');                  // ... output display...                 break;             default:                 // application error; display error page, don't                 // change status code                 break;         }     } }