note 25742 deleted from function.eval by victor
| From: | victor@php.net | Date: | Sat, 12 Jun 2004 22:38:38 +0000 |
| Subject: | note 25742 deleted from function.eval by victor | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-70996@lists.php.net to get a copy of this message | ||
Note Submitter: Alchemist at OzDNS
----
Eval on form input fields.
in response to :
adamhooper at videotron dot ca
on : 08-Aug-2002 01:45
is this not ok to clean the input from a form thus :
$count = count($HTTP_POST_VARS);
$g=0;
while($g<$count){
list($name, $value) = each($HTTP_POST_VARS);
$str = "$".$name."= strip_tags($".$name.");";
$str = addslashes($str);
// clean the HTTP_POST_VAR value
$value = strip_tags($value);
// clean the variable by name
eval($str);
$g++
}
note :
This cleans both the values called from
$HTTP_POST_VARS and the values called from the
variables.
By just cleaning the $value from $HTTP_POST_VARS
did not clean the value returned from a call to
the $variable name itself.
-Alchemist