Re: Security/$_REQUEST vars... How do you do it?

Hi Comex, thanks for the quick response, I really appreciate it. :) On Dec 3, 2005, at 3:29 PM, comex wrote:

empty is a language construct, not a function, so that is not necessary. You can just do !empty(...).

Oh, do you mean that I should do this instead: if((isset($_REQUEST['sub'])) && !empty($_REQUEST['sub'])) {

You could return false or return true, or simply return !empty($x);

Ahhh, great point!

However, that doesn't actually work ... and could cause a notice if it isn't; and $x will always be defined, even if set to null.

Yes, I actually just realized this via testing/experimenting... :(

Since your variables are coming from REQUEST anyway, you could write it like this: function security_check($x) { return !empty($_REQUEST[$x]); } Then, if(!security_check('sub')) { ... }

Ah, great idea, thanks! You have been very helpful, thanks. :D