note 31076 added to control-structures.foreach

SECURITY ISSUE I've often seen people use foreach to declare & process all the POST vars in one go with this: foreach ($_POST as $key => $value) { $$key = addslashes($value); } This is extremely unsafe. A forged form could have submitted any var with any value to your processor script. If they know / guess a previously declared var in the same scope as the foreach code, it would be overwritten (for example an $access_level var could be reset to 'admin'). The safe way to do it would be: foreach ($_POST as $key => $value) { ${'prefix_' . $key} = addslashes ($value); } .. or better still if the POST vars are stored in a db for later display in a browser (as they usually are): foreach ($_POST as $key => $value) { ${'prefix_' . $key} = htmlspecialchars(addslashes(trim($value))); } Of course, you have to be sure that your choice of string for 'prefix_' isn't part of a valid variable name... -- http://www.php.net/manual/en/control-structures.foreach.php http://master.php.net/manage/user-notes.php?action=edit+31076 http://master.php.net/manage/user-notes.php?action=delete+31076 http://master.php.net/manage/user-notes.php?action=reject+31076