PHP: how to handle $ _POST data
I am getting a netbeans warning when using this code. Can anyone post some code that will not show warnings in netbeans and will achieve what I want. Does my code have a security flaw?
...
The warning I'm getting says: "Never access Superglobal $ _POST directly. Use some filter function instead."
...
<?php
//test if required vars are set
if (
isset($_POST['num']) &&
isset($_POST['desc'])
) {
(double) $num = filter_var($_POST['num'], FILTER_SANITIZE_NUMBER_FLOAT, FILTER_FLAG_ALLOW_FRACTION);
$desc = $_POST['desc'];
//do stuff after with these vars such as: mysqli queries; equations with ! === || &&.
}
?>
+3
source to share
2 answers
Try using this:
<?php
if (filter_input(INPUT_POST, 'num') && filter_input(INPUT_POST, 'desc')) {
(double) $num = filter_input(INPUT_POST, 'num', FILTER_SANITIZE_NUMBER_FLOAT, FILTER_FLAG_ALLOW_FRACTION);
$desc = filter_input(INPUT_POST, 'desc');
//do stuff after with these vars such as: mysqli queries; equations with ! === || &&.
}
+1
source to share
I wouldn't worry too much about this warning, even on the line where you actually use the filter function (although a different option than NetBeans suggests ...) generates the same message.
These are hints that should make you think about what you are doing and can be very helpful.
However, if you don't want to see them, you can go to:
Tools > Options > Editor > Hints
And disable individual warnings separately.
0
source to share