Re: unserialize() data from untrusted source

Hello Markus, I've done both many times. There are many ways to do this type of thing, but the way I described it is very clean because the data is always in sync with the page (due to the fact that the data is on the page). If you save the data to a session, and then click back a couple times, it can really mess with things, creating a much more complex scenario to deal with. As I said, over the years I've done both, and this is what I've settled on as the most practical. -- Best regards, Jason mailto:jason@ionzoft.com Monday, September 6, 2004, 1:28:22 AM, you wrote: MF> Jason Garber wrote: >> This is an interesting point you bring up. When we have large >> registration processes or similar multi-page forms, we write our >> data array to a hidden field using. >> >> base64_encode(serialize($aData)) >> >> and read it in with >> >> unserialize(base64_decode($_POST['aData'])) >> >> passing it from page to page with POST. MF> I fail to understand, in your scenario, why you don't simply save the MF> data in a session? MF> You're effectively generated some data server and send it to the client MF> only to get it back on the next request; typical session scenario, if MF> you ask me. MF> cheers, MF> - Markus