fareforce Posted August 21, 2009 Share Posted August 21, 2009 I have never been good with looping, but I know there has to be a better way other than what I am doing. I have an html form that has a lot of fields, and is using the POST method, and sending it to my php file. In my php file I currently have $First_Name = $_POST[First_Name']; $Last_Name = $_POST[Last_Name']; $Address = $_POST['Address']; $City = $_POST['City']; $State = $_POST['State']; $Zip = $_POST['Zip']; $Phone = $_POST['Phone']; $Mobile = $_POST['Mobile']; $email = $_POST['email']; ....etc. and it works fine, but I am just trying to clean it up a little. What is a better way of doing this? Quote Link to comment Share on other sites More sharing options...
MadTechie Posted August 21, 2009 Share Posted August 21, 2009 You could use extract() ie extract($_POST); echo $First_Name; Quote Link to comment Share on other sites More sharing options...
fareforce Posted August 21, 2009 Author Share Posted August 21, 2009 You could use extract() ie extract($_POST); echo $First_Name; Does extract() automatically set all of the variables to the html form input id? (ie. $first_name, $last_name, etc? Quote Link to comment Share on other sites More sharing options...
fareforce Posted August 21, 2009 Author Share Posted August 21, 2009 I checed it out, and it works great! Thank you much! I guess I was trying to do it the hard way! Quote Link to comment Share on other sites More sharing options...
MadTechie Posted August 21, 2009 Share Posted August 21, 2009 Well personally I do it the hard way.. and rarely use extract. I find i either use $_POST[First_Name'] or I filter it before setting it to a variable. Quote Link to comment Share on other sites More sharing options...
thebadbad Posted August 21, 2009 Share Posted August 21, 2009 It's a bad idea to use extract() on user input like the $_POST array, at least when it's used without a safer flag than the default EXTR_OVERWRITE. E.g. if your script looks like this (worst case scenario): <?php $admin = false; extract($_POST); if ($admin) { //admin access } ?> A user could simply POST admin=something to the script and gain admin access. Quote Link to comment Share on other sites More sharing options...
PFMaBiSmAd Posted August 21, 2009 Share Posted August 21, 2009 Edit: Basically says the same as above ^^^ If you are going to use extract(), set the second parameter to EXTR_PREFIX_ALL and use a unique prefix (3rd parameter.) This will cut down on the number of hackers breaking into your script because extract() without doing that will allow a hacker to set any of your existing program variables to anything he wants. So if you have code like $admin = 1; (a common variable name used to indicate you are an administrator to your script) a hacker could just set that by providing a POST variable by that same name and value. Quote Link to comment Share on other sites More sharing options...
thebadbad Posted August 21, 2009 Share Posted August 21, 2009 without doing that will allow a hacker to set any of your existing program variables to anything he wants. But only if your variables are set before running extract(), or if they aren't initiated before use (just to clarify). Quote Link to comment Share on other sites More sharing options...
MadTechie Posted August 21, 2009 Share Posted August 21, 2009 WOW i'm kinda shocked i forgot to add EXTR_SKIP Quote Link to comment Share on other sites More sharing options...
newbtophp Posted August 21, 2009 Share Posted August 21, 2009 Hmm Im wanting to code something using a similar technique, do you mind taking a look? http://www.phpfreaks.com/forums/index.php/topic,266075.msg1254768.html Quote Link to comment Share on other sites More sharing options...
Recommended Posts
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.