For Each $_POST Variable A Mysql_real_escape_string?

For my school homework I have to create a function that uses trim(), htmlspecialchars() and mysql_real_escape_string() to prevent SQL- and HTML injection. I've been trying for a w

Solution 1:

What about this

foreach($_POST as $key => $value) {
    echo 'Current value in $_POST["' . $key . '"] is : ' . $value . '<br>';
    $_POST[$key] = your_filter($value);
}

where your_filter() is your function calling trim, htmlspecialchars, etc. :

function your_filter($value) {
    $newVal = trim($value);
    $newVal = htmlspecialchars($newVal);
    $newVal = mysql_real_escape_string($newVal);
    return $newVal;
}

Pay attention to the variable name too which is $_POST not $_Post. You don't need to use $$ here, you have the key name in the loop in $key and you can access/replace the value in the array with $_POST[$key]

EDIT : added an echo to print current value

EDIT2 : added an example of your_filter() function

Solution 2:

// $_POST = array('voorletters' => '<<', 'tussenvoegsel' => '>>', 'naam' => '<<');

foreach($_POST as &$val) //pass any post value by reference
   $val = mysql_real_escape_string(htmlspecialchars(trim($val)));


extract($_POST);
echo $voorletters;
echo $tussenvoegsel;
echo $naam;

Solution 3:

foreach ($_POST as $Key => $Value) { 

 echo yourFunctionName($Value)."<br/>"; 

}

Solution 4:

Try This...

function real_escape_and_trim($value)
{
    $value = trim($value);
    $value = mysql_real_escape_string($value);
    return $value;
}

foreach($_POST as $key => $value)
{
    $_POST[$key] = real_escape_and_trim($value);
}

$field_name = $_POST['field_name'];