form process using php

Question

for form process what's better ? (secure/fast)

Layout Form :

<form id="myForm" name="frm1" action="insert.php" method="post">
<textarea name="content" id="content" cols="35" rows="5"></textarea>
<INPUT type=submit value="submit" name=submit></form>

Insert php :

<?php
if (( 'POST' == $_SERVER['REQUEST_METHOD'])) {
 //php validation code
} else {
 exit();
}
?> 

Or

<?php
if (!isset($_POST['submit'])) {
 //php validation code
} else {
 exit();
}
?>

• Charming Prince: what form are you trying to process?
• Levi Morrison: I personally prefer the former. I don't know that there is a correct answer

Answer 1

The second one, definitely. It's more readable. and even more logical

<?php 
if (isset($_POST['submit'])) { //php validation code
 //do something 
}
else
{
 exit();
} 
?>

Answer 2

You should generally be checking whether or not the data exists that you are going to process. Along those lines, your second method is preferred, but don't assume people are going to click your submit button.

I have a couple other notes for you while I'm at it. You should really close your <input> tag with /> at the end of it.

Also, while you can make comparisons like ('POST' == $_SERVER['REQUEST_METHOD']), writing them in that order makes little sense. Flip it around like this: ($_SERVER['REQUEST_METHOD'] == 'POST')

Answer 3

Speed is irrelevant here. In terms of security these two cakes of code are diferents...

if (( 'POST' == $_SERVER['REQUEST_METHOD']))
{//php validation code
}
else 
{exit();}

Here you are testing if the request method of your page is post, and then you do your validations.

if (!isset($_POST['submit'])) 
{//php validation code
}
else
{exit();}

Here you are testing if there is a value in the post values that has the key "submit". You are assuming that a field has this name, but that is not necessarily true. You can have post values with any field named "submit".

The real security concern here are your validation tests.

• user1086738: if merge if (( 'POST' == $_SERVER['REQUEST_METHOD'])) && isset($_POST['submit']) { ... }else { ... } Now?
• macjohn: I guess that when php fills the $_POST array is when the request method is post. It is redundant to check this.

Answer 4

if (!isset($_POST['submit'])) 
{//php validation code
}
else
{exit();}

Second one makes more sense to me.

Answer 5

The second answer is the best, because you're only checking on your submit button. The other one is checking for just a post .