Some input validation and processing

index.php

@@ -3,6 +3,7 @@ locale_set_default('de_DE');
 $config = require_once './config.php';
 $START_DATE = $config['start_date'];
 $EVENTS = $config['events'];
+$CITIES = ['Berlin', 'Potsdam', 'Magdeburg', 'Braunschweig', 'Hannover', 'Leipzig'];
 
 if ($_SERVER['REQUEST_METHOD'] == "POST") {
   $n = 0;
@@ -10,7 +11,21 @@ if ($_SERVER['REQUEST_METHOD'] == "POST") {
     $file_name = $config['data_dir'] . "/" . time();
     $file = fopen($file_name, "x");
   } while ($file === false && ++$n < 5);
-  if (!$file || !fwrite($file, var_export($_POST, true))) {
+  $data = ['dates' => []];
+  $string_keys = ['name', 'email'];
+  foreach ($_POST as $key => $v) {
+    if (($key == 'city' && in_array($v, $CITIES)) ||
+        ($key == 'count' && is_numeric($v)) ||
+        (in_array($key, $string_keys))) {
+      $data[$key] = $v;
+    } else if (preg_match('/^date_(\d\d\d\d-\d\d-\d\d)$/', $key, $matches) && $v == "on") {
+      $data['dates'][] = $matches[1];
+    } else {
+      echo "Invalid value " . htmlspecialchars($v) . " for key " . htmlspecialchars($key);
+      exit;
+    }
+  }
+  if (!$file || !fwrite($file, json_encode($data))) {
     echo "Leider konnte deine Anmeldung nicht gespeichert werden. Bitte melde dich bei luetzi-vernetzung-bb@systemli.org damit wir den Fehler beheben können!";
     exit;
   }
@@ -115,7 +130,7 @@ Alle Angaben sind freiwillig. Sie werden nur gespeichert, um euch zu kontaktiere
 <label class=row><input name=email type=email placeholder=feldmaus@posteo.de>Deine E-Mail-Adresse</label>
 <h2>Allgemeines</h2>
 <label class=row><input name=count type=number value=1>Wie viele seid ihr?</label>
-<label class=row><select name=city><option>Berlin</option><option>Potsdam</option><option>Magdeburg<option>Braunschweig<option>Hannover<option>Leipzig</select>Deine Stadt</label>
+<label class=row><select name=city><?php foreach($CITIES as $city) { echo "<option>$city"; } ?></select>Deine Stadt</label>
 <p class=row><input type=submit value=Abschicken>
 </form>
 </main>