Question

I wrote a foreach loop and saved on several lines of code. It basically takes all of the $_POST variables and uses their names to create normal php variables.

foreach(array_keys($_POST) as $str)
{
${$str}=mysqli_real_escape_string($connection,trim($_POST["$str"]));
}

It is working as expected, creating variables dynamically.

Now, I wanted to put it inside a custom function so i modified it like this:

function createvariablesfromPOST()
{
    foreach(array_keys($_POST) as $str)
    {
    ${$str}=mysqli_real_escape_string($GLOBALS["connection"],trim($_POST["$str"]));
    }
    return //something;
}

Its not working obviously, because i dont know how to make this function return // something (whatever that thing may be) to the global scope. Whats supposed to be done here?

I cant make the foreach loop return anything, till the loop is complete. Isn’t that so?

Please help.

Answer 1

Assigning arbitrary variables supplied by the user could be EXTREMELY DANGEROUS! They can overwrite any of your variables.

The reason it isn’t working, is because they aren’t in the global scope. You would have to do something like $GLOBALS[$variable] = 'something';

Instead, you should assign the variables to an array so they are isolated from the global scope. i.e. $input[$$var] = $escaped_value;