[RESOLVED] converting post variables into session variables

mberman

I have a script in which I take a whole lot of data from a number of pages of a form, compile it into one, and let the user edit it before it's eventually thrown into a SQL database. The data coming from the forms is in post, and I've created arrays of all of the fields in the form, like:

$arr_page1 = array("firstname","middlename","lastname");

Then, I should be able to loop through the array to convert each of those from post to session variables, like

foreach($arr_page1 as $this) {
     $_SESSION["$this"] = $_POST["$this"];
}

Is there a better way of doing it this way? This seems finicky (I always end up playing with it to get the quotes right... at the moment, it's not working).

Any ideas?

laserlight

I think you are actually looking to write:

foreach ($arr_page1 as $key => $value) {
	$_SESSION[$key] = $value;
}

I think that some input validation may be in order.

mrfritz379

if no input validation is going to be used (which is a bad idea), then you could use something as simple as

$_SESSION = array_merge($_SESSION, $_POST);

and skip the foreach loop.

mberman

ah, alright. thanks. there is minimal input validation, but it all occurs on the "summary" page. this is the way that the client decided they wanted it. i may strip special charecters at hte very least, but they decided to do much of hte input validation by hand. it's a very low traffic website, so i guess they decided it would be cheaper. i couldn't really convince them otherwise. i agree it's not the best decision at all, but i have to go with the cleint's decision.

anyways, thanks for the help, as usual!

leatherback

mberman wrote:
ah, alright. thanks. there is minimal input validation, but it all occurs on the "summary" page. this is the way that the client decided they wanted it. i may strip special charecters at hte very least, but they decided to do much of hte input validation by hand. it's a very low traffic website, so i guess they decided it would be cheaper. i couldn't really convince them otherwise. i agree it's not the best decision at all, but i have to go with the cleint's decision.

anyways, thanks for the help, as usual!

Hm.. I do not agree. Isn't it your job to make sure the work is done properly? Your client probably does not have any insight in the risk of sql injection and stuff. Whereass you are hired as the 'expert' to get this going.

I do not understand how you can do validation of userinput by hand, unless you have somebody waiting for data to come in, and give an OK vefore it is inserted into the database. You HAVE TO verify the data which comes froma form before entering it into you database, and preferably that is the very first thing you do with the posted variables.

mberman

that is a good point. more of what i'm talking about here is i guess "form validation" and such. i am runinng input through to strip special charecters, etc. but i'm not say, validating that an email address contains an "@" symbol and a ".", etc. that's the part that they're doing by hand. if it were my own, i would have, say, checked to make sure that emails are valid, phone numbers are valid, etc. but they didnt' want to do that part of it. i do agree with you though, that it definitely needs to check for those things to be a secure application and not put a whole server of data at risk. i'm sorry for the term confusion on my part.

since it's not running on a production server, but a devel server, i'm taking my time to get the rest of the application working so i can see how it all lays out. i'll then go back through and make sure that input isn't dangerous.