[SOLVED] $_POST Looping help

[fareforce]

I have never been good with looping, but I know there has to be a better way other than what I am doing.

 

I have an html form that has a lot of fields, and is using the POST method, and sending it to my php file. In my php file I currently have

$First_Name = $_POST[First_Name'];
$Last_Name = $_POST[Last_Name'];
$Address = $_POST['Address'];
$City = $_POST['City'];
$State = $_POST['State'];
$Zip = $_POST['Zip'];
$Phone = $_POST['Phone'];
$Mobile = $_POST['Mobile'];
$email = $_POST['email'];
....etc.

 

and it works fine, but I am just trying to clean it up a little. What is a better way of doing this?

[MadTechie]

You could use extract()

ie

extract($_POST);
echo $First_Name;

 

 

[fareforce]

You could use extract()

ie

extract($_POST);
echo $First_Name;

 

 

 

Does extract() automatically set all of the variables to the html form input id? (ie. $first_name, $last_name, etc?

[fareforce]

I checed it out, and it works great! Thank you much! I guess I was trying to do it the hard way!

[MadTechie]

Well personally I do it the hard way.. and rarely use extract.

 

I find i either use $_POST[First_Name'] or I filter it before setting it to a variable.

[thebadbad]

It's a bad idea to use extract() on user input like the $_POST array, at least when it's used without a safer flag than the default EXTR_OVERWRITE. E.g. if your script looks like this (worst case scenario):

 

<?php
$admin = false;
extract($_POST);
if ($admin) {
//admin access
}
?>

 

A user could simply POST admin=something to the script and gain admin access.

[PFMaBiSmAd]

Edit: Basically says the same as above ^^^

 

If you are going to use extract(), set the second parameter to EXTR_PREFIX_ALL and use a unique prefix (3rd parameter.) This will cut down on the number of hackers breaking into your script because extract() without doing that will allow a hacker to set any of your existing program variables to anything he wants. So if you have code like $admin = 1; (a common variable name used to indicate you are an administrator to your script) a hacker could just set that by providing a POST variable by that same name and value.

[thebadbad]

without doing that will allow a hacker to set any of your existing program variables to anything he wants.

 

But only if your variables are set before running extract(), or if they aren't initiated before use (just to clarify).

[MadTechie]

WOW i'm kinda shocked i forgot to add EXTR_SKIP

[newbtophp]

Hmm Im wanting to code something using a similar technique, do you mind taking a look?

 

http://www.phpfreaks.com/forums/index.php/topic,266075.msg1254768.html