POST sanitizing and avoiding nested if blocks

Question

When sanitizing the $_POST passed from the controller to the model, I need to sanitize the input and there are 2 options that I can think of.

For the first one, I can nest the if blocks like this:

if(!empty($username))
{
 if(!empty($password))
 {
 //login the user
 }
 else 
 {
 echo 'Please enter password.'
 }
 }
 else 
 {
 echo 'Please enter username.'
 }

And the other one is like this:

 if(empty($username))
 {
 $err[] = 'Please enter username'; 
 }
 if(empty($password))
 {
 $err[] = 'Please enter password.'; 
 }
 if(empty($err)){
 //login the user
 }
 else
 {
 //display error
 }

Which way is the preferred one and is there another, smarter way of sanitizing the input?

• 200_success: These two options — at least the excerpts you have shown us — aren't equivalent.
• user3628807: This is just an example.
• 200_success: On Code Review, we review real code, not concepts. See the help center.
• user3628807: Ok, I edited my examples. How about now?

Answer 1

Personally I find if it is a short function, that you do your validation and exit early, these are usually called "guard" clauses

What you are doing here is more what I would call validation, than sanitizing. Eg. sanitizing would be escaping data before feeding it into and sql statement.

$err = [];
if(empty($username))
{
 $err[] = 'Please enter username'; 
}
if(empty($password))
{
 $err[] = 'Please enter password.'; 
}
if(count($err) > 0 ) {
 //display error
 return; 
}
//login the user

• user3628807: What is the difference between if(count($err) > 0 ) { and if($err)
• bumperbox: Not much really, just because it is an array i use count, it is just out of habbit, what i was really trying to illustrate is splitting that last if/else block, to keep it similar to the if block's you have above it.