Feat/force validation

src/ajax/check_hgvs_dialogue.php

@@ -35,17 +35,30 @@
 header('Content-type: text/javascript; charset=UTF-8');
 
 
+// Check whether all required input was given.
+if (!(isset($_REQUEST['var']) && isset($_REQUEST['action'])
+    && isset($_REQUEST['fieldName']) && isset($_REQUEST['refSeqInfo']))) {
+    // If any of these variables are missing, we cannot correctly
+    //  perform any checks, so we will exit the script.
+    exit;
+}
+if (!isset($_REQUEST['transcripts'])) {
+    // Let's assume the transcripts were empty if this variable was not set.
+    $_REQUEST['transcripts'] = '';
+}
+
+
 // Retrieving the transcripts to map to.
 // We are using REQUEST and not GET or POST, because the
 //  input of this script can be both GET and POST.
-$aTranscripts = (empty($_REQUEST['transcripts'])? array() : explode('|', urldecode($_REQUEST['transcripts'])));
+$aTranscripts = (empty($_REQUEST['transcripts'])? array() : explode('|', $_REQUEST['transcripts']));
 
 // Retrieving the name of the input field.
-$sFieldName = htmlspecialchars(urldecode($_REQUEST['fieldName']));
+$sFieldName = htmlspecialchars($_REQUEST['fieldName']);
 
 
 
-if (!($_REQUEST['var'])) {
+if (!empty($_REQUEST['var'])) {
     // If the variant is empty, we can simply close the script.
     exit;
 }
@@ -59,17 +72,16 @@
     //  found, we know that the input was the reference sequence
     //  of a transcript.
     $sType = 'VOT';
-    $sReferenceSequence = urldecode($_REQUEST['refSeqInfo']);
-    global $_DB;
+    $sReferenceSequence = $_REQUEST['refSeqInfo'];
     $bRefSeqIsSupportedByVV = (
-        'hg' == substr($_DB->query('SELECT id FROM ' . TABLE_GENOME_BUILDS . ' LIMIT 1')->fetchColumn(), 0, 2)
+        'hg' == $_DB->query('SELECT LEFT(id, 2) FROM ' . TABLE_GENOME_BUILDS . ' LIMIT 1')->fetchColumn()
     );
 
 } else {
     // We know we got information on a GB. This is given through
     //  JS in the format of <genome build ID>-<chromosome>.
     $sType = 'VOG';
-    list($sGenomeBuildID, $sChromosome) = explode('-', urldecode($_REQUEST['refSeqInfo']));
+    list($sGenomeBuildID, $sChromosome) = explode('-', $_REQUEST['refSeqInfo']);
     $sReferenceSequence = (
         !isset($_SETT['human_builds'][$sGenomeBuildID])?
         '' : $_SETT['human_builds'][$sGenomeBuildID]['ncbi_sequences'][$sChromosome]