I want to declare these variables Game_id and Member_id in advance. Following the suggestion
from one of my books can I do something like this:

$expected = array('Game_id', 'Member_id');
foreach($expected AS $key) {
    if ( !empty($_POST[$key])) {
      ${$key} = $_POST[$key];
    }
    else {
     ${$key} = NULL;
    }
}
      case "addmember":
      switch ($_GET['type']) {
        case "membergame":
          $sql = "INSERT INTO xsm_membergames
                    (Game_id,
                    Member_id)
                  VALUES
                    ('" . mysql_real_escape_string((int)$_POST["Game_id"]) . "',
                    '" . mysql_real_escape_string((int)$_POST["Member_id"]) . "')";
          break;
      }
      break;

My concern is did I achieve anything with the code I just added to declare the variables? Is it actually being passed to this:

      case "addmember":
      switch ($_GET['type']) {
        case "membergame":
          $sql = "INSERT INTO xsm_membergames
                    (Game_id,
                    Member_id)
                  VALUES
                    ('" . mysql_real_escape_string((int)$_POST["Game_id"]) . "',
                    '" . mysql_real_escape_string((int)$_POST["Member_id"]) . "')";
          break;
      }
      break;

I did add this and tested it on my server and I didnt recieve any errors. So how can I be sure its doing what I intended?

    What's the use of creating new variables if you don't use them ? In your query, you use the $_POST array directly, not the variable you created earlier !!!

      I was afraid this would be the answer lol. Im trying to learn how to validate the input before it is posted. Maybe Im interpreting my reading wrong. So what I was trying to do was declare the variables so that anything other than what was declared would become null or harmless.

      suntra wrote:

      What's the use of creating new variables if you don't use them ? In your query, you use the $_POST array directly, not the variable you created earlier !!!

        I probably titled this thread wrong and didnt format my question correctly. What I was seeking knowledge on was how to validate the input a user submits before it is actually posted.

          Write a Reply...