|
Posted by zorro on 05/07/06 14:18
greetings...
I'm wondering what more advanced coders would think ot this:
$_POST['myvar'] = clean($_POST['myvar']);
and now I can use POST directly:
$sql= "select * from T1 where myvar='$_POST[myvar]' " ;
function clean($var){
return addslashes(trim($var)); // whatever
}
The reason I came up with this is because i often end up calling
clean() several times on the same variable. So to avoid declaring a php
variable for each posted one, I would use an array
$arr['myvar']=clean($_POST['myvar'])) ;
$arr['myvar2']=clean($_POST['myvar2'])) ;
but since $_POST is already there, why not use it? The benefit is
simpler code, but maybe there are some security issues - that's what I
don't know.
Navigation:
[Reply to this message]
|