Naming variables automatically from $_POST array.

Question

My PHP script processes some POST variables.

Instead of manually naming each variable

$name = $_POST['name'];
$email = $_POST['account'];

I'd like my script to grab all the variable names from the $_POST array and automatically create variables with those names, e.g. (not code, just illustrating the principle)

foreach ($_POST as $name => $value) {
    $[$name] = $value;
}

Is something like that possible?

It's called variable name variable. Code in your loop should be `$$name = $value;`. However, don't do it. — N.B., Apr 11 '14 at 09:00
you sir, search for register_globals, it has been turned off and removed from php forever for good reason, security and stuff http://stackoverflow.com/questions/1417373/why-is-register-globals-so-bad — Joshua, Apr 11 '14 at 09:02
Because you can overwrite variables you declared before, which can (and definitely will) lead to undesired behaviour. — N.B., Apr 11 '14 at 09:05

score 2 · Accepted Answer · answered Apr 11 '14 at 09:03

You can use the extract function for this. But there is a risk, because you cannot know what data is posted, and it will create or overwrite variables in the scope in which you call it, possibly leading to unexpected behaviour.

You can partially counter this, using one of the flags for extract, for instance:

extract($_POST, EXTR_SKIP);

Anyway, make sure to read the two warnings (red block) on the documentation page of this function. And of course, the same warning applies when you do this using your own foreach loop, so answers suggesting that are no more secure.

score 1 · Answer 2 · answered Apr 11 '14 at 09:02

1

There is extract function in php:

extract($_POST);

answered Apr 11 '14 at 09:02

xdazz

158,678
38
247
274

score 1 · Answer 3 · answered Apr 11 '14 at 09:05

This is a very bad idea because it allows a user to create any variable in your PHP script (within the scope that it this code is used). Take for example if you have a $debugging flag:

$debugging = false;

foreach ($_POST as $name => $value) {
    $$name = $value;
}

// some time later, we do a query and output the SQL if debugging
if($debugging){
    echo $sql;
}

What if a malicious user submitted an input called debugging with a value of 1? Your debugging flag would be changed and the user could see sensitive debug data.

What if someone would post input called `sql` with a value of `DROP TABLE users`... — GolezTrol, Apr 11 '14 at 09:09

Fluffeh · Answer 4 · 2014-04-11T09:05:05.343

You can do this with variable variables as follows:

foreach ($_POST as $name => $value) {
    $$name = $value;
}

You can also use the following format if you want to muck about with the variable names some more:

foreach ($_POST as $name => $value) {
    ${$name.'_1'} = $value;
}

There are comments here saying don't use variable variables - mainly because they are hard as heck to troubleshoot, make it damn hard for others to read your code and will (for the most part) create more headaches than they solve.

score 0 · Answer 5 · answered Apr 11 '14 at 09:01

0

Try this (which is a bad practice):

foreach ($_POST as $name => $value) {
    $$name = $value;
}

answered Apr 11 '14 at 09:01

Guns

2,678
2
23
51

Naming variables automatically from $_POST array.

5 Answers5