RE: [PHP-DB] MultSelect ListBox hell!
| From: | Ford, Mike | Date: | Wed, 22 Sep 2004 16:07:31 +0000 |
| Subject: | RE: [PHP-DB] MultSelect ListBox hell! | ||
| Groups: | php.db | ||
| Request: | Send a blank email to php-db+get-36342@lists.php.net to get a copy of this message | ||
> -----Original Message-----
> From: John Holmes [mailto:holmes072000@charter.net]
> Sent: 22 September 2004 16:39
>
> From: "Ford, Mike" <M.Ford@leedsmet.ac.uk>
> >> if (is_array($_POST['state'])){
> >
> > This check isn't really necessary in PHP, since
> $_POST['state'] will
> > *always* be an array if the form field has NAME='state[]', even if
> > only 1 is selected.
>
> But remember that the form comes from the client. Just
> because you create
> the form with "state[]", that doesn't mean I'm going to send
> it that way. ;)
Yeah, true -- I have a very bad tendency to forget about security considerations like that until
someone reminds me (often a posting on this list does it ;). Just because I have a well-defined set
of well-behaved users...!!
Cheers!
Mike
---------------------------------------------------------------------
Mike Ford, Electronic Information Services Adviser,
Learning Support Services, Learning & Information Services, JG125, James Graham Building, Leeds
Metropolitan University, Headingley Campus, LEEDS, LS6 3QS, United Kingdom
Email: m.ford@leedsmet.ac.uk
Tel: +44 113 283 2600 extn 4730 Fax: +44 113 283 3211