Question

I am new to PHP.

I have been advised to sanitize $_GET and $_POST. I have been following this advice.

However, if I just want to check the variable with

if(isset($_GET['login']))

do I need to do any sanitization on that?

Also, do I need to sanitize $_SESSION values I use?

Answer 1

No, you do not have to do any kind of sanitization or anything : isset() will allow you to check if the variable (or item array, in your case) exists — and that’s pretty much it.

Here, as you are testing whether the item/variable exists or not, you cannot sanitize it : to sanitize the data, you need it to exist.

Note, though : isset() will return false if that item exists, but is null !

Which, in the case of a $_GET item, will quite not probably happen.