Question

I’ve got a little issue about validating PHP variables from a form.

For example:
I post a variable from a form to a PHP file.

$event_name = mysql_real_escape_string($_POST['event-name']);
if ($event_name=='' || $event_name==null)
{
    /* send error message */
}

I used the above code and got an error whenever the $_POST[‘event-name’] is empty.
Will there be any problem/consequence if I use it like:

$event_name = $_POST['event-name'];
if (mysql_real_escape_string($event_name)=='' || mysql_real_escape_string($event_name)==null)
 {
    /* send error message */
 }

Or am I doing it wrong?

Thanks

Answer 1

The PHP isset method is used to see if there is something in the POST. Suggest using the following method:

if (!isset($_POST['event-name']) || $_POST['event-name'] == "")
{
    /* send error message */
}
else
    $event_name = $_POST['event-name'];

only use mysql_real_escape_string at the point of issuing the mysql query.