note 70636 deleted from function.array-filter by cmb
| From: | cmb@php.net | Date: | Sun, 06 Oct 2019 08:09:42 +0000 |
| Subject: | note 70636 deleted from function.array-filter by cmb | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-212492@lists.php.net to get a copy of this message | ||
Note Submitter: Fladnag - bahatest at ifrance dot com
----
If you have a form with multiple checkbox having ID element as value for selection in a list, you
probably have a SQL request like :
$req="SELECT ... WHERE ID IN (".implode(',',
array_keys($choices)).")";
without quote before and after choices keys because they are numeric values... but in fact, they can
be string values, and a SQL injection problem.
with array_filter, you can easily filter bad values :
<?php
$choices=array('A'=>'on', -1=>'on', 0=>'on',
1=>'on', 12=>'on', "1)or 1=1--"=>'on');
print_r($choices);
$choices=array_filter(array_keys($choices), 'is_numeric');
print_r($choices);
?>
will print :
<?php
Array
(
[A] => on
[-1] => on
[0] => on
[1] => on
[12] => on
[1)or 1=1--] => on
)
Array
(
[1] => -1
[2] => 0
[3] => 1
[4] => 12
)
?>