You may have heard of the saying "Garbage In - Garbage Out".
What we need to ensure with our testing of the script is that if "garbage" is fed into the script that the script deals with it appropriately.
As well as the expected and acceptable values that our script is intended to handle in order to do what the script is there to do we also have two additional types of data we need to test.
Expected but unacceptable values are those that the visitor to our site is able to generate as input to our script. This data is expected because visitors can input these values even though the script is not expected to be able to do its normal processing when such values are entered. It is absolutely essential that you test this type of input into your script in order to ensure that the script treats this data appropriately. In many cases the appropriate treatment is to produce an error message telling your visitor what is wrong with their input so that they can correct it.
Of course with some scripts it may not even be obvious what these expected but unacceptable values are until you run a series of tests using a range of values and suddenly discover that there are values which do not produce the expected results. Then you need to modify both your expected test results and the code in order to avoid the unexpected results that you got from the first test.
The other group of values you need to consider testing are those that are both unexpected and unacceptable.These are values that should never occur in the script because there is no way that your visitor should be able to cause the script to try to process those values - unless something goes wrong. Basically this sort of testing is done on sections of your code in order to ensure that the particular section of code can deal with unacceptable input values that should never reach that piece of code if something stuffs up elsewhere that results in such values being passed.