Jump to content

[SOLVED] $_POST Looping help


fareforce

Recommended Posts

I have never been good with looping, but I know there has to be a better way other than what I am doing.

 

I have an html form that has a lot of fields, and is using the POST method, and sending it to my php file. In my php file I currently have

$First_Name = $_POST[First_Name'];
$Last_Name = $_POST[Last_Name'];
$Address = $_POST['Address'];
$City = $_POST['City'];
$State = $_POST['State'];
$Zip = $_POST['Zip'];
$Phone = $_POST['Phone'];
$Mobile = $_POST['Mobile'];
$email = $_POST['email'];
....etc.

 

and it works fine, but I am just trying to clean it up a little. What is a better way of doing this?

Link to comment
Share on other sites

It's a bad idea to use extract() on user input like the $_POST array, at least when it's used without a safer flag than the default EXTR_OVERWRITE. E.g. if your script looks like this (worst case scenario):

 

<?php
$admin = false;
extract($_POST);
if ($admin) {
//admin access
}
?>

 

A user could simply POST admin=something to the script and gain admin access.

Link to comment
Share on other sites

Edit: Basically says the same as above ^^^

 

If you are going to use extract(), set the second parameter to EXTR_PREFIX_ALL and use a unique prefix (3rd parameter.) This will cut down on the number of hackers breaking into your script because extract() without doing that will allow a hacker to set any of your existing program variables to anything he wants. So if you have code like $admin = 1; (a common variable name used to indicate you are an administrator to your script) a hacker could just set that by providing a POST variable by that same name and value.

Link to comment
Share on other sites

This thread is more than a year old. Please don't revive it unless you have something important to add.

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Reply to this topic...

×   Pasted as rich text.   Restore formatting

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

×
×
  • Create New...

Important Information

We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.