string and isinteger

Hi. I created a GUIDE UI and I am trying to determine whether an input into an editable textbox is an integer.

If I do:

[I,OK] = str2num(get(handles.no_ADC,'String'));
disp(isinteger(I))

The output is 0 (or false), because str2num converts strings into type floating. I thought about doing

isinteger(uint8(I))

but that is useless too because it would just convert an I=3.2 to 3 and return true, which is not what I want.

Is my only option to do

strfind(num2str(I),'.')

since this will tell me if there is a decimal point in I, which means its not an integer?

Answer 1

[Fangjun Jiang]

try this

a=[1 1.1 -1 -1.2]
TF=a==round(a)

[Jan]

+1: Exactly. Exception: round(Inf)==Inf.

ISINTEGER checks the *type* of the variable, not the *value*.

Answer 2

[Jan]

Note that STR2NUM accepts characters also, because it uses EVAL to computer the reply:

str2num('sin(pi)')   % 1.2246e-016

and do not try this:

str2num('!format C:')

Therefore it is recommended to avoid STR2NUM to convert inputs from the user-land if it is possible. SSCANF is safe. The following converts the input to an integer automatically:

Num = round(sscanf(get(handles.no_ADC,'String'), '%f', 1));
if isempty(Num)
  warning...
else
  set(handles.no_ADC, 'String', sprintf('%d', Num));
end

E.g. "1.0" is read as [1] and converted to "1".

[Daniel Shub]

Wow, that is totally and completely unsafe. I cannot believe that is not in the documentation. I think from now on I am going to have to try and "break" other peoples programs with a nicer version of that.

You could use str2double, which looks like it doesn't use eval.

[Walter Roberson]

It *is* in the documentation, and is why mlint flags str2num and recommends using str2double instead.

[Jan]

@Daniel: I think, your comment has the same level of humor as my example. "!format C:" looks dangerous, but it does not work since WindowsNT anymore. In addition, users typing such commands cannot complain, because they are the most unsafe part in the system.

The real problem is more using "O" or "l" (upper-case oh, lower-case el) instead of "0" or "1" (zero, one). Then num2str can evaluate a function or local variable instead of showing an error. Then possible side-effects are more likely than extremly stupid and/or bold users.

A realistic scenario is a GUI which is shipped to the customers in compiled form. Then applying EVAL to user inputs can reveal internal details by injecting code, e.g. by typing "whos" instead of a number. Equivalent tricks are used to hack web-based databases as internet-shops etc, ask Google for "sql injection" to learn more.

Although I assume the the OP does not use the input to contact a database, which contains critical information, it is a good idea to mention security risks in this public forum.

Answer 3

[Daniel Shub]

validateattributes(I, {'numeric'}, {'integer'})

You may need to wrap it in a try/catch block since validateattributes throws an error if the check doesn't pass.