如何验证股市数据

Question

Honestly, I am not an expert & right now very much confused about how to even state my problem...so please forgive my lack of knowledge and this long confusing question.

I was assigned a project today where the clients are displaying stock market's info on their page (image attached below). And when you click on any one of the buttons (for example, NASDAQ) more info is displayed in a pop-up box.

They are using onClick() to send the whole string to this third party to collect the data. Here is the HTML code for NASDAQ link:

    <li>
        <a href="#" onClick="open('https://app.quotemedia.com/quotetools/clientForward?symbol=^NASD&targetURL=http://app.quotemedia.com/quotetools/popups/quote.jsp?webmasterId=99944&locale=en_US','miniwin','toolbar=0,location=0,directories=0,status=0,menubar=0,scrollbars=0,resizable=1,width=550,height=270,top=20,left=0'); return false;">  

           NASDAQ             
           <span id="imageNASDAQ"></span> 
           <span id="valueNASDAQ" class="share_value"></span> 
           <span id="textNASDAQ"></span> 
        </a> 

        <script type="text/javascript" src="/getStockInfo.php?Stocks[NASD]=NASDAQ"></script>
    </li>

And then in getStockInfo.php file they are collecting the data as a JSON string and then parsing it. Here's how they are collecting the data:

    <?php
    if (array_key_exists("Stocks", $_GET)) {
        foreach($_GET['Stocks'] as $symbol=>$stock) {
           print file_get_contents("https://app.quotemedia.com/quotetools/jsVarsQuotes.go?webmasterId=99944&symbol=$symbol");
    ?>

So far pretty simple. But now the client wants to do some

• "user input validation"
• "Only accept 4 symbols: SP500, SPX, DOW & NASDAQ"

This is where I am getting confused. From their code (HTML part) looks like everything is hard coded ( open('...symbol=^NASD...'); or open('...symbol=^SPX...'); or open('...symbol=^DJI...'); ) and each button/link is sending specific Stock symbol's info to the getStockInfo.php file ( src="/getStockInfo.php?Stocks[NASD]=NASDAQ" or src="...Stocks[SPX]=SP500" or src="...Stocks[DJI]=DOW" ) where the stock quotes are being fetched. There is absolutely NO way my client's users can provide any other stock symbols through the site to change the display, the only way to manipulate the symbols are by changing the code itself.

BUT, my client wants to implement these above 2 conditions in the code anyhow. And I am not sure how to do this.

Not sure if I was able to explain my problem properly :( But I really need some help. Also I'm sorry for not being able to provide any link to the actual page here. Thank you so much for reading my confusing post and investing your time!! :)

Answer 1

Here's a proof of concept:

if (array_key_exists("Stocks", $_GET)) {
    $stocks = array_filter($_GET['Stocks'], 'filterStocks');
    foreach ($stocks as $symbol => $stock) {
        print file_get_contents(…);
    }
}

function filterStocks($symbol) {
    return in_array(
        $symbol, 
        array('SP500', 'SPX', 'DOW', 'NASDAQ')
    )
}

Now getStockInfo.php will only return data for the four symbols. If you need that configurable on an individual user basis, a simple solution would be to do change the filterStocks function and callback to

function filterStocksForLoggedInUser($symbol) {
    return in_array($symbol, getAllowedSymbolsForUser());
}

function getAllowedSymbolsForUser()
{
    $permissions = include '/path/to/permissions/file.php';
    return isset($permissions[$_SESSION['username']])
        ? $permissions[$_SESSION['username']]
        : array();
    }
}

and then in the permissions file put

return array(
    'Walahh' => array('SP500', 'SPX', 'DOW', 'NASDAQ'),
    'JohnDoe' => array('SP500', 'GOOG')
);

Note 1: the above assumes you have some sort of way to identify users, here $_SESSION['username'] . Change that with whatever you are using and adjust the permission file accordingly.

Note 2: the permissions file will be read each time from disk. Disk I/O is usually slow, so you might want to consider moving the permissions to someplace faster.

Note 3: this is just a proof of concept. It's very pragmatic. You can certainly improve the design and structure, but I guess it's good enough to illustrate how to approach the problem.