Escaping strings

[ChaosKnight]

Hi, I have a form that posts data to the database, so I'm very concerned about the security...

 

My question is if this will work?:

    foreach ($_POST as $field => $value){
      $$field = mysql_real_escape_string(strip_tags(trim($value)));
    }

 

Any help will be greatly appreciated

[Ken2k7]

What's $$field? You'll need to use $_POST[$field].

[Daniel0]

What's $$field? You'll need to use $_POST[$field].

 

http://dk2.php.net/manual/en/language.variables.variable.php

 

 

As for the question, you don't need to use strip_tags when inserting into a database, and I would be wary about creating variables dynamically like that. You risk overriding other variables, which is why register globals is discouraged and deprecated.

[Ken2k7]

What's $$field? You'll need to use $_POST[$field].

 

http://dk2.php.net/manual/en/language.variables.variable.php

+1

 

Thank you.

[ChaosKnight]

So is this secure enough to go to the database?:

$message = mysql_real_escape_string($_POST['message']);

[Daniel0]

Assuming you're using MySQL, yes, that should be sufficient in most cases.