php search form

Question

am fiddling around with a search form i've managed to string together which works. In total there is a possibility to input 28 values including checkbox's and selection options. So i have this code repeated 28 times with different variables, is there a shorter way to do this, it looks so nasty in my code which leads me to believe am doing something very wrong. Here is an example of my code:

            $search_shop_name = '';

            if(isset($_GET['search_shop_name'])) {
            $search_shop_name = $_GET['search_shop_name']; 
    }               
    else {
        $search_shop_name = '';
    }

That is just 1 piece of code for one input, imagine how long and sloppy this code is. Any advice would be appreciated. thanks

Arnaud Le Blanc · Accepted Answer · 2011-09-03 15:41:33Z

3

Use filter_input()^[docs]. It will shorten your code to a single line:

$search_shop_name = filter_input('search_shot_name', INPUT_GET);

Or do something like this:

// put your default values here
$defaults = array(
    'search_shop_name' => '',
    'other_value' => '',
    ...
);

// merge $_GET in default values
$input = array_merge($defaults, $_GET); // or $_GET + $defaults

// you are done
$search_shop_name = $input['search_shop_name'];

answered Sep 3, 2011 at 15:41

Arnaud Le Blanc

100k24 gold badges211 silver badges196 bronze badges

Sign up to request clarification or add additional context in comments.

5 Comments

Renai Over a year ago

the second answer worked Perfectly, thanks so much. i must read up on this array_merge. Code looks alot tidier now.

Renai Over a year ago

Hi, ive been reading about injection and fiddling with, strip_tags, strip_slashes, mysql_real_escape and htmlspecialchars. But enter a element: <h1>, the H1 takes effect and breaks the site. Am trying to prevent tags from being inserted into the input box. I have considered a large number of options for a select menu to ensure the user doesn't type in tags.

Arnaud Le Blanc Over a year ago

Just use htmlspecialchars() when you echo a variable. Don't filter input. Escape output. Just do echo htmlspecialchar($variable).

Renai Over a year ago

i've input <h1> to test this and i returns: <h1> I have read that i MUST escape data users enter. Are there any websites or programmes to show my websites vunerabilities rather than putting it online to get taken apart in no time ?

Arnaud Le Blanc Over a year ago

That's wrong, you must only escape data you output. Not the input.

Christopher Armstrong · Accepted Answer · 2011-09-03 15:42:22Z

1

Instead of using all those conditionals, you could simply do:

$search_shop_name = $_GET['search_shop_name'];

If the $_GET value isn't set, then $search_shop_name will be an empty string.

answered Sep 3, 2011 at 15:42

Christopher Armstrong

7,9812 gold badges28 silver badges28 bronze badges

2 Comments

Maerlyn Over a year ago

If it isn't set, it'll emit an E_NOTICE. I find it a good habit to write code that doesn't do that.

Arnaud Le Blanc Over a year ago

This triggers errors if $_GET['search_shop_name'] is not set. I believe this is what OP tries to avoid by using isset().

Collectives™ on Stack Overflow

php search form

2 Answers 2

5 Comments

2 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

5 Comments

2 Comments

Your Answer

Sign up or log in

Post as a guest

Related