Question

I wrote this, and wanted to get everyones opinion. I use this when I’m expecting a variable from a FORM submission. Ie:

<form method="post" action="index.php">
Username: <input type="text" name="username">
</form>

$username = get_request('username');

function get_request($name) {
    if(isset($_REQUEST[$name])) {
        //return mysql_real_escape_string(htmlentities($_REQUEST[$name]));
        return mysql_real_escape_string($_REQUEST[$name]);
    } else {
        return "";
    }
}

Answer 1

While mysql_real_escape_string() does a good job, you may wish to be stricter on what you return. E.g. if you only need alphanumeric characters it would be safer (and possibly faster) to do:

return preg_replace('/[^a-z0-9]/', '', $_REQUEST[$name]);

Or even use filter_var if you are running PHP 5.2+.

Also as mentioned above, you if you can easily use $_POST instead of $_REQUEST if you are only handling POST data.

Other than than that, keep up the good work! 🙂