Question

I have three $_GET variables and I want to check if they are correctly being passed.

$amnt = $_GET['amnt'];
$from = $_GET['from'];
$to = $_GET['to'];

if ($_GET != 'amnt' || $_GET != 'from' || $_GET != 'to' ) {
    $errorno = 1100;
    echo $errorno;
    exit;

I have tried this so far, however this just checks the parameters inside the $_GET rather than the acutal amnt=&from= etc. As someone could put in ammount=&frommm=

Answer 1

You should just check if a certain parameter you’re interested in is set and if so, use it. Like:

if (isset($_GET['from'])) {
    // use $_GET['from']
}

If you require a certain number of parameters to be set, check for them all:

if (isset($_GET['from'], $_GET['to'], $_GET['amnt'])) ...

If any other parameters are set or if the parameters are misspelled, ignore them. If you really want to check that no other parameters are set, you can do so like so:

if (array_diff_key($_GET, array_flip(array('amnt', 'from', 'to')))) {
    // some other keys are set!!
}

But what’s the point, really? If you just ignore those parameters, who cares? And additional parameters can be useful for debugging, like example.com/foo?DEBUG=true. If you check too strictly, you’re only creating problems for yourself later.