note 74946 added to security.globals

Rather than taking everything from $_REQUEST, you could add a validation filter. This way you only get the variables that you expect. Such a filter could validate and cast type. // this code will only make $one, $two, $three $varType = array('one'=>'int', 'two'=>'str', 'three'=>int); foreach($_REQUEST AS $key => $value) { if ($varType[$key] == 'int') { ${$key} = (int) $value; } elseif ($varType[$key] == 'str') { ${$key} = strip_tags($value); } } ---- Server IP: 64.71.164.2 Probable Submitter: 166.70.15.246 ---- Manual Page -- http://www.php.net/manual/en/security.globals.php Edit -- https://master.php.net/note/edit/74946 Del: integrated -- https://master.php.net/note/delete/74946/integrated Del: useless -- https://master.php.net/note/delete/74946/useless Del: bad code -- https://master.php.net/note/delete/74946/bad+code Del: spam -- https://master.php.net/note/delete/74946/spam Del: non-english -- https://master.php.net/note/delete/74946/non-english Del: in docs -- https://master.php.net/note/delete/74946/in+docs Del: other reasons-- https://master.php.net/note/delete/74946 Reject -- https://master.php.net/note/reject/74946 Search -- https://master.php.net/manage/user-notes.php