Submitting form with Reg_globals=Off

patrick42

I'm new to PHP and I'm trying to start off on the right foot by declaring register_globals = Off. The problem I am running into is that most of the tutorials are written for = On with only rudimentary =Off info.

This simple script below illustrates my problem.

<HTML>
<?php
if($submit)
{
$db = mysql_connect("localhost", "root","");
mysql_select_db("learndb",$db);

$first=$post[first];
$last=$post[last];
$nick=$post[nick];
$email=$post[email];
$salary=(int)$_post[salary];

$sql = "INSERT INTO personnel (firstname, lastname, nick, email, salary)
VALUES ('$first', '$last', '$nickname','$email','$salary')";
$result = mysql_query($sql);
echo "Thank you! Information entered.\n";
}
else
{
?>
<form method="post" action="input.php">
First name:<input type="Text" name="first"><br>
Last name:<input type="Text" name="last"><br>
Nick Name:<input type="Text" name="nickname"><br>
E-mail:<input type="Text" name="email"><br>
Salary:<input type="Text" name="salary"><br>
<input type="Submit"name="submit" value=" Enter information"></form>
<?
}
?>
</HTML>

I was able to declare the variables $first, $last etc. but I am getting errors because of the $submit variable is called before being defined. What is the proper syntax for defining the submit var?

Also, does anyone know of any resources (tutorials, books, etc) that deal with post PHP 4.2 implementations and/or register_globals = off?

Thanks,

Pat

jesus_hairdo

You don't have to form the $name variables, you can just use the $POST[name] in its place.
So instead of using $submit, just use $POST[submit]

dalecosp

Originally posted by patrick42
Also, does anyone know of any resources (tutorials, books, etc) that deal with post PHP 4.2 implementations and/or register_globals = off?

Thanks,

Pat

The manual, check out the sections on "predefined variables" and "reserved variables"; also, perhaps, the section on "security."

Basically, the essence is that you are now defining from whence the variables came (the superglobals $POST[], $GET[], $_COOKIE[], etc.) so that scr|pt kiddi3z can't stick them in the URL (get) and supersede the values you intended to place there...

HTH, and though I said RTFM this is not a flame 🙂

diego25

What is the proper syntax for defining the submit var?

You should use isset to check if the variable has been declared. e.g.

if (isset($submit)) {
// do stuff
}

Diego