[Resolved] Turning field names of $_POST[] into variables

Trilogen

Trying to turn field name variables of $_POST[] into variables this is what I have but PHP is giving me this error:

Parse error: parse error, unexpected $ in process.php on line 316

foreach($_POST as $name => $value){
$value = strip_tags($value);
$$name  = $value;
}

where $ is declaring the variable and $name next to is as the name of field comming from $_POST[]

What's a better approach to doing this?

Installer

"extract()" is a better approach.

bradgrafelman

[man]extract/man

Note that using the POST'd names as the variable names is a security risk; anyone can overwrite varialbes you've set in the script by doing so. A better way would be to fix your function, and prepend "post_" to the variable name, like so:

foreach($_POST as $name => $value){ 
${'post_'.$name}  = strip_tags($value);
}

EDIT: Woopsie.. forgot to add the 'post_' part!

Installer

$_POST['test1'] = '<b>Hello</b>';
$_POST['test2'] = '<i>World</i>';

foreach ($_POST as $name => $value) { 
    $_POST[$name] = strip_tags($value);
}
extract($_POST, EXTR_PREFIX_ALL, 'post');

echo $post_test1 . '<br />';
echo $post_test2 . '<br />';

Edit: Oops. Index name corrected.

bradgrafelman

Ha. Never used extract; I always declared variables as I needed them to avoid overwriting or malicious injections. Guess I need to read the manual more 😉

Trilogen

Originally posted by bradgrafelman
[man]extract/man

Note that using the POST'd names as the variable names is a security risk; anyone can overwrite varialbes you've set in the script by doing so.

How is that possible?

bradgrafelman

Easy.

File -> Save as, and save the HTML page to your computer. Open up the HTML, and add this at the top:

'<base href="http://thewebsite.com/folder/file/was/in/">'

and then this inside the form:

'<input type="hidden" name="variableHere" value="valueHere">'

madwormer2

Well, if you are using a variable name that is only set if a certain condition is met (i.e if logged in $authenticate_user = "yes") yet you do not declare it as a variable otherwise, then all the user would have to do was prepend file.php?authenticate_user=yes and then he would have access.

Or something similar, I believe

Probably should get rid of extract($POST);
extract($GET);
in all of my codes eh? Lol.

bradgrafelman

No. Just use the solution that's been mentioned above, using EXTR_PREFIX_ALL in extract() to prepend a keyword to all variables.

Installer

Also, "extract()" returns the number of variables extracted,

[deprecated]
so for a bit of extra checking you could do this:

$extracted_num = extract($_POST, EXTR_PREFIX_ALL, 'post');
if ($extracted_num != $expected_num) {
exit('Uh oh, Beaver...');
}
[/deprecated]

bradgrafelman

Except, every time he changes the layout/form/etc. he would have to remember to reset that number in the script 🙁

Installer

That's what ini files are for. 🙂

bradgrafelman

True, but still, he would have to either remember how many in total were added/removed, or he'd have to submit a dummy form to see how many elements came through, etc. every time he changed something.

Realistically, it always seemed like it was easier just to prepend the POST/GET names with a keyword and just extract() em all, so I can use the oens I want in my script, and don't have to worry about any others.