On Monday 27 October 2003 20:47, Burhan Khalid wrote:

> The notice is basically saying that you are trying to assign a value to
> a variable for an index that doesn't exist (so the value of the variable
> can't be guaranteed).
>
> One way is to verify that the index exists before you assign its value
> to a variable. This is my favorite way :
>
> $var = isset($_POST['key']) ? $_POST['key'] : NULL;
>
> You might also want to check out extract() -- which does the same thing.

extract() does NOT do the 'same' thing. extract() blindly extracts everything 
in $_POST (or $_GET if you're using that) into the variable space. This 
allows a malicious user to inject variables that you may not have anticipated 
and thus defeats the purpose on having register_globals = off.

> By the way -- pat yourself on the back for going with
> error_reporting(E_ALL). Its one of the first steps towards effective
> programming. :)

I second that.

-- 
Jason Wong -> Gremlins Associates -> www.gremlins.biz
Open Source Software Systems Integrators
* Web Design & Hosting * Internet & Intranet Applications Development *
------------------------------------------
Search the list archives before you post
http://marc.theaimsgroup.com/?l=php-general
------------------------------------------
/*
In the eyes of my dog, I'm a man.
                -- Martin Mull
*/

-- 
PHP General Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php

Reply via email to