Question

The user can only enter a number between 1 and 5 – if they enter 0, leave the field blank or enter a number greater than 5 it will be default reset to 5. 1,2,3,4 are accepted otherwise.

$max=mysql_real_escape_string($_POST["max"]);

if ($max=="0" || $max==""){
    $max_r="5";
} elseif ($max > "5"){
    $max_r="5";
} else {
    $max_r=$max;
}

However it always spits out 5.

Answer 1

Well, you’re comparing strings and not integers. Try $max = (int) $_POST['max'] and don’t wrap the values in quotes. Then, you can always escape $max before writing it to the DB.

$max = (int) $_POST['max'];

if ( ! $max || $max > 5){
  $max_r = 5;
} else {
  $max_r = $max;
}

Or, you could go one-liner FTW:

$max_r = ( ! $max || $max > 5) ? 5 : $max;