Re: [Nolug] php help: storing from variable # of form entries

From: Brett D. Estrade <estrabd_at_yahoo.com>
Date: Fri, 29 Aug 2003 06:54:32 -0700 (PDT)
Message-ID: <20030829135432.70109.qmail@web41506.mail.yahoo.com>

Glad you got it ... just a couple (or 6) suggestions:

1) test $enter using "if(isset($_POST['enter'])){..."
2) "<?" is just as good as "<?php" in 99% of the servers out there
3) comment the code so that you can remember what is doing 3 weeks from now :)
4) use double quotes around all attribute values, for example:
   <input type="submit" name="enter" value="Submit">
5) if possible, utilize the $_POST array
6) validate any user input with "htmlentities" to reduce the possibility of cross-site scripting
attacks

Check out the articles here for some tips on web app security:
http://www.freebsdforums.com/forums/showthread.php?threadid=13571

Brett

--- "Christopher M. Jones" <cjones12@tulane.edu> wrote:
> OK, got it. Thanks, everyone, for all your help. I love having you guys
> around. Here's what I needed:
> <html>
> <body>
>
> <form action="<?php echo $PHP_SELF?>" method="post">
>
> <?php
>
> if($enter){
> for($i=0; $i < 3; $i++) {
> $a = "data_$i";
> echo $$a;
> echo "</br>";
> }
> }
>
> $row[0] = data0;
> $row[1] = data1;
> $row[2] = data2;
> for ($i=0; $i < 3; $i++){
> echo $row[$i];
> echo "<input type=text name=data_$i size=3></br>";
> }
>
> ?>
> <input type=submit name=enter value=Submit>
> </form>
> ___________________
> Nolug mailing list
> nolug@nolug.org

=====
http://www.brettsbsd.net/~estrabd

__________________________________
Do you Yahoo!?
Yahoo! SiteBuilder - Free, easy-to-use web site design software
http://sitebuilder.yahoo.com
___________________
Nolug mailing list
nolug@nolug.org
Received on 08/29/03

This archive was generated by hypermail 2.2.0 : 12/19/08 EST