[cosmicappuccino]

Hi,

I'm having some trouble getting some PHP to work and wanted to confirm the below.

Is it ok to have a concatenated key when accessing $_POST?
For example, I might have a FOR loop in which $i is the variable incremented. Then, can I access $_POST['book1'], $_POST['book2'], etc. by putting in each loop:
$_POST['book'.strval($i)]
?

In case it is useful, the $_POST value is being used in a mysql INSERT query, which doesn't seem to be working.

Thanks for the feedback! (:

[gregwhitworth]

Yeah - I don't see why not. But why would you do the following:

$_POST['book' . $i];

That would produce book1, book2, etc...

But for security reasons, have you cleaned/sterilized your data before inserting it?
--

Greg

This post has been edited by gregwhitworth: 05 August 2009 - 09:55 AM

[cosmicappuccino]

Thanks for the answer, Greg!

As for the sterilization -- what would you normally recommend doing before inserting data? In this particular case, the variables will be alphanumeric only, but I'm not totally clear on this issue so would appreciate any guidelines for future use.

Thanks again,

[Wimpy]

You should always check if the received data contains only what you expect, in this case alphanumerics, you could use ctype_alnum() or the preg_match() functions. You always also escape the data, preferably with some native function like mysql_real_escape_string() for MySQL databases!

cosmicappuccino, on 5 Aug, 2009 - 08:05 PM, said:

Thanks for the answer, Greg!

As for the sterilization -- what would you normally recommend doing before inserting data? In this particular case, the variables will be alphanumeric only, but I'm not totally clear on this issue so would appreciate any guidelines for future use.

Thanks again,

[gregwhitworth]

Even still, if the user is allowed to input data into your SQL database without you sterilizing it - you have the capability of having your data hacked.

http://www.dreaminco...wtopic37214.htm

Read up on it a little, you want to do as much as you can to be secure. I still am working on maintaining security in my user inputted values, but it is a practice that you should learn, and learn early.

[cosmicappuccino]

Thanks a lot, both of you. That's really helpful (:

[Wimpy]

No problem, note that you shouldn't only consider protecting yourself against sql injections since that is just one of a thousand different threats, but, it the end, everything ends up in validating incoming data and auth'ing users (authenticating and authorizing)!

Here's a link to some links you could follow to read up on, I haven't read them myself yet, to be honest:
http://en.wikipedia....curity_exploits

This post has been edited by Wimpy: 05 August 2009 - 12:43 PM