php - Securing POST data in Router -

i trying figure out best way of sanitizing , degree validating post data sent app.

i made function resides in router , called in __constructor if($_post) present:

private function validatepost()   {     foreach($_post $key => $value) {       if(preg_match('/[^a-za-z]/', $key))       {         $this->throwerror('post error', 'invalid index name.');         return;       }       if(strlen($value) > $this->postlimit && $this->postlimit != -1)       {         $this->throwerror('post error', 'posted value large.');         return;       }       if(substr($key, -2, 2) == 'id' && !is_numeric($value))       {         $this->throwerror('post error', 'expected number, didn\'t one.');         return;       }       else       {         //$value = urlencode($value);       }       $_post[$key] = $value;     }   } 

it little strict on purpose doesn't matter if stick rules have made throughout framework.

i have read limiting size of $_post helps in thwarting attacks, in case put -1 no/default limit (but can set less if needed in config file).

i commented out urlencoding unsure of best way decode when arrives @ intended function. should encode @ , best way decode it? perhaps in master controller classes extend or not?

any other suggestions welcome.

if want limit size of post requests, best option @ level of webserver itself. there tools that. since using apache, mod_security. other webservers have similar options.

when limiting size of post request, 1 of risk amount of memory used execution of page. if data in $_post late.

as validation , sanitation should done either in domain objects, presentation entities or sql ... validate logic of input in domain objects. walidate structure of data in sql constraints. , sanitize output in presentation entities (i don't link call them "presentation models" because adds confusing mvc).

the routing mechanism in mvc (which "front controller aspect of) should take input user , organize in structured request instance. intance used controller's action pass data on model layer.

routing should not validating input.