Re: Training Help
| From: | Jon Haworth | Date: | Fri, 12 Sep 2003 11:39:29 +0000 |
| Subject: | Re: Training Help | ||
| References: | 1 2 3 | Groups: | php.general |
| Request: | Send a blank email to php-general+get-162411@lists.php.net to get a copy of this message | ||
Hi Ryan,
> $tireqty = $_POST['tireqty'];
> $oilqty = $_POST['oilqty'];
> $sparkqty = $_POST['sparkqty'];
That'll certainly fix the problem, but it kind of defeats the point of using
$_POST :-)
Ideally you'd clean the data at this point to make sure no-one's trying to
submit anything nasty (Google on "SQL injection" for an idea of what can be
done).
Seeing as these are quantities, checking them via PHP's is_numeric()
function would probably be a good idea, and making sure they're inside
sensible ranges (between 0 and 50, say) might be worthwhile as well.
Cheers
Jon