PHP Dynamicaly Create Variables From Form Input Name Field

Creative variables in PHP on the fly.

[nigassma]

Here's the scenario:

We have a form with 50 input fields. Each input field has it's own name and I could create variables with PHP by hand like this:

<?php
$donationtype = $_POST["donationtype"];
$howardnichols = $_POST["howardnichols"];
$inMemoryofCustom = $_POST["inMemoryofCustom"];
$inMemoryofCustomName = $_POST["inMemoryofCustomName"];
?php>

However in an ideal setting, the variables would be created dynamically with some scripting.

The eventual goal is to pass these variables to a final data review panel that would contain an echo of the current value of said variable and an option to edit that input value via a microlink without having to go back to the original input page.

At this point it would probably be easier in the immediate future to create all of the variables by hand that way I don't have to script a variable driven action when it comes to the "Edit" microlink, but it may work better in the long run for my predecessors.

Any thoughts on if it is necessary and how I would do it would be greatly appreciated.

[bkeep]

Something like this should get you started

foreach ($_POST as $field => $value ) {
${$field} = $value;
}

[nigassma]

OK so if I have those same four inputs and I want to echo the variables how would I display those dynamic variable values?

Right now I'm just echoing the variables I created manually.

<?php
echo "Donation Type ".$donationtype.
echo "<br /> Howard Nichols ".$howardnichols;
echo "<br /> In Memory Of ".$inMemoryofCustom.;
echo "<br /> In Memory Name ".$inMemoryofCustomName;
?php>

[bkeep]

You would output the same way as before
print "$donationtype";

[nigassma]

OK, so by doing this I'm only skipping the listing of variable steps. I'm in fact just assuming that all of the input names are going to be variables. Be-a-you-tafil.

[coopster]

Careful about doing it this way. I could spoof your form and set up my own input field ...

<input name="admin" value="1">

Now I have just created the $admin variable in your script with a true value.

[nigassma]

Which way? The manual or automatic way? And by creating an admin variable what do you gain if none of the information is sent to a database?

[idfer]

If i may expand on coopster's warning... With the automatic way (with the foreach($_POST ...)) you're basically implenting register_globals on: [php.net...] and it's not just the risk of setting a variable like $admin, a hacker could also call your script with e.g. _SERVER[DOCUMENT_ROOT]=url_to_their_server and override your PHP super-globals at will.

Also if you use "standard" global variables like dbname, dbuser, dbpassword, the hacker can override these too to point to their own database, etc. Who knows, hackers will try everything, you'll have to be super careful to make sure your script is secure.

Here are two ways that are a bit more secure:

1) You still need to maintain a list of all these variable names somewhere, so you can figure out the label for each of them, maybe:

$labels = array(
'donationtype' => 'Donation Type',
'howardnichols' => 'Howard Nichols',
...
);

If you have such an array, you could do:

foreach (array_keys($labels) as $field) {
${$field} = $_POST[$field];
}

2) Name all your form fields as array elements, e.g.

<input type="text" name="userdata[donationtype]" ...>
<input type="text" name="userdata[howardnichols]" ...>

And in your script:

$userdata = $_POST['userdata'];
...
echo "Donation Type ".$userdata['donationtype'];
echo "<br /> Howard Nichols ".$userdata['howardnichols'];
...

[nigassma]

Security trumps my laziness this time. Blasted! If I explicitly list all of the variables within my script instead of have them be created on the fly, is there still a security risk?

And again, if there is no interaction with a database within my script/form is it even possible to access the DB (that doesn't exist).

[jatar_k]

if you create them all explicitly and test types/lengths/patterns then no there shouldn't be any of the basic security risks

though you aren't going to a db you must be doing something with it or you wouldn't be collecting it

so email? file?

either way all these things can be exploited so test each individually

[andrewsmd]

If you want to generate them dynamically is it because you have to print them across multiple pages and if you edit one you want the change to be reflected throughout the website? If so, store them in a database and populate them that way. It's still somewhat dynamic but you know what all of the names are.