iterate through function arguments by reference

[amygdala]

Hi again,

Thanks for taking the time again to help me out. Much appreciated. I'm
pretty new to PHP so I'm exploring the possibilities of the language a bit.

Here's my problem:

I would like to iterate through arguments passed to a function, modify them
but still let them hold there original name. To be precise: I want users to
fill in a register form and once submitted, trim() all field values after
being passed to the function register().

Maybe my effort so far will clear it up even more:

// original list of arguments is quite longer
function register( $firstname, $lastname, $birthdate )
{
// loop through all arguments and modify them by reference
// someting like:
foreach( func_get_args() as $key =$value )
{
$key = trim( $val );
}
// echo trimmed argument $firstname
echo $firstname;
}

Is that possible?

Cheers

[C.]

amygdala wrote:

>
I would like to iterate through arguments passed to a function, modify them
but still let them hold there original name. To be precise: I want users to
fill in a register form and once submitted, trim() all field values after
being passed to the function register().

Yes it is possible - and its such a general question that there are
lots of different ways to do it.

The idea of modifying the data in-situ gives me a bit of a problems
though. In any user facing application there are three things you need
to do: validate, validate and VALIDATE. If you're trying to bolt on
validation to an exisitng system then it is already seriously flawed.
I, and I suspect most programmers, would want to keep the cleaned up
data well seperated from the raw data e.g. by putting it somewhere
else:

function clean($in)
{
$out=array();
foreach($in as $key=>$val) {
$out[$key]=transform($val);
}
return($out);
}

register(clean($_REQUEST));

You should also be thinking about protecting your system from injection
attacks and making the data more palatable to whatever storage
mechanism you are using...

function transform($datum)
{
$cleaned=trim($datum);
$cleaned=htmlentities($cleaned);
$cleaned=mysql_escape_string($cleaned);
return($cleaned);
}

Of course, if you really must, then $_POST, $_REQUEST et al are
writable as well as readable in your script:

$_GET=transform($_GET);

Will have the effect you want.

Note that the title of your post is a bit misleading - in the examples
above I've not modified the data pased as parameters, but it is
possible to pass references to variables instead of passing copies of
the variables - see the PHP manual for more details.

HTH

C.

[C.]

amygdala wrote:

>
I would like to iterate through arguments passed to a function, modify them
but still let them hold there original name. To be precise: I want users to
fill in a register form and once submitted, trim() all field values after
being passed to the function register().

Yes it is possible - and its such a general question that there are
lots of different ways to do it.

The idea of modifying the data in-situ gives me a bit of a problems
though. In any user facing application there are three things you need
to do: validate, validate and VALIDATE. If you're trying to bolt on
validation to an exisitng system then it is already seriously flawed.
I, and I suspect most programmers, would want to keep the cleaned up
data well seperated from the raw data e.g. by putting it somewhere
else:

function clean($in)
{
$out=array();
foreach($in as $key=>$val) {
$out[$key]=transform($val);
}
return($out);
}

register(clean($_REQUEST));

You should also be thinking about protecting your system from injection
attacks and making the data more palatable to whatever storage
mechanism you are using...

function transform($datum)
{
$cleaned=trim($datum);
$cleaned=htmlentities($cleaned);
$cleaned=mysql_escape_string($cleaned);
return($cleaned);
}

Of course, if you really must, then $_POST, $_REQUEST et al are
writable as well as readable in your script:

$_GET=transform($_GET);

Will have the effect you want.

Note that the title of your post is a bit misleading - in the examples
above I've not modified the data pased as parameters, but it is
possible to pass references to variables instead of passing copies of
the variables - see the PHP manual for more details.

HTH

C.

[amygdala]

"C." <co************@gmail.comschreef in bericht
news:11*********************@i42g2000cwa.googlegro ups.com...

amygdala wrote:

>>
I would like to iterate through arguments passed to a function, modify
them
but still let them hold there original name. To be precise: I want users
to
fill in a register form and once submitted, trim() all field values after
being passed to the function register().

Yes it is possible - and its such a general question that there are
lots of different ways to do it.

The idea of modifying the data in-situ gives me a bit of a problems
though. In any user facing application there are three things you need
to do: validate, validate and VALIDATE. If you're trying to bolt on
validation to an exisitng system then it is already seriously flawed.
I, and I suspect most programmers, would want to keep the cleaned up
data well seperated from the raw data e.g. by putting it somewhere
else:

function clean($in)
{
$out=array();
foreach($in as $key=>$val) {
$out[$key]=transform($val);
}
return($out);
}

register(clean($_REQUEST));

You should also be thinking about protecting your system from injection
attacks and making the data more palatable to whatever storage
mechanism you are using...

function transform($datum)
{
$cleaned=trim($datum);
$cleaned=htmlentities($cleaned);
$cleaned=mysql_escape_string($cleaned);
return($cleaned);
}

Of course, if you really must, then $_POST, $_REQUEST et al are
writable as well as readable in your script:

$_GET=transform($_GET);

Will have the effect you want.

Note that the title of your post is a bit misleading - in the examples
above I've not modified the data pased as parameters, but it is
possible to pass references to variables instead of passing copies of
the variables - see the PHP manual for more details.

HTH

C.

I see your points, and I am aware of the importance of validating user input
and preventing SQL injection. I'm using PDO's prepare function and execute
statement, amongst other things.

I didn't see much danger in overwriting user input arguments by cleaned up
values though. Anyway, your suggestions were not what I had in mind exactly
but it looks like your approach is the smarter thing to do anyway.

Thanks!