note 75769 deleted from language.variables.variable by danbrown
| From: | danbrown@php.net | Date: | Wed, 24 Jun 2009 16:50:32 +0000 |
| Subject: | note 75769 deleted from language.variables.variable by danbrown | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-157389@lists.php.net to get a copy of this message | ||
Note Submitter: mike dot d dot richman at gmail dot com
----
AKAM -- Your example does shorten your code, but I think it could cause trouble. If I understand
correctly, one could design any form that posts to your page. Possible problems I can think of:
1) A crafted form contains a field that overwrites an important, existing variable in your script.
2) A crafted form posts an absurd number of variables, possibly slowing down your script.
3) A crafted form posts excessively large variables (I'm not sure what this can cause but it
can't be good).
If you do the following, you can specify which data you want while perhaps still shortening your
code:
<?php
$vars = array ('name', 'email', 'content');
foreach ($vars as $var) {
$$var = $_POST[$var];
}
?>