Re: [PHP] $_POST vs $_REQUEST

Hi Slack-Moehrle

Slack-Moehrle wrote on 22/02/2010 21:39:
> Hi All,
> 
> I have Forms that I submit for processing. I have seen examples of people using either $_POST or $_REQUEST.
> 
> When would I choose one over the other?

$_REQUEST['test'] is true on both $_GET['test'] and $_POST['test']

I use it from time to time if I have a edit link followed by a form 
posting (where I use method=post), if I decide to have all editing in 
one statement, IE:

if($_REQUEST['test']) {
   if($_GET['test']) {
     // make the form here
   }
   elseif($_POST['test']) {
   // get posting from the form
   }
}

> Also, I see examples of these being used with and without the single quotes
> 
> Like:
> 
> $_POST[j_orderValue]
> or
> $_POST['j_orderValue']
> 
> Single quotes is best, correct to prevent sql injection?

Best practice is with '', if you have E_NOTICE on you'll get notices if 
you use $_POST[test] instead of $_POST['test']

It has nothing to do with SQL injection here. But when dealing with SQL 
statements it's best practice to use '', for instance if you are about 
to insert and a number at some point could be inserted as part of the 
statement: "price = 250" will do fine, but if price ain't entered "price 
= " will cause an error, while "price = ''" will not make the sql insert 
fail.

Regarding SQL injection, run all inputs through the function 
mysql_real_escape_string()

-- 
Kind regards
Kim Emax - masterminds.dk