I did this php code
<?php
if (!isset($_GET['id']) or !is_numeric($_GET['id'])) {
header('Location: index.php');
} else {
extract($_GET);
$id = strip_tags($id);
require_once 'config/functions.php';
$errors = array();
if (!empty($_POST)) {
extract($_POST);
$author = strip_tags($author);
$comment = strip_tags($comment);
if (empty($author)) {
$errors = array_push($errors, 'Entre a nickname');
}
if (empty($comment)) {
$errors = array_push($errors, 'Entre a comment');
}
var_dump($comment);
var_dump($author);
var_dump($errors);
if (count($errors) == 0) {
$comment = addComment($id, $author, $comment);
$sucess = 'Your comment has been sent';
unset($author);
unset($comment);
}
}
$article = getArticle($id);
$comments = getComments($id);
}
However, when I submitted the form I saw that every time the submission was successful so I decided to dump the variables $errors , $comment and $author to try to solve the issue. Here, the array $errors no matter what was empty. I tried not to put the comment or the author or even both but it still isn't working.
Could you help me out with this problem guys because I really don't know from where it comes from?
$errors = array_push($errors, that is not what you wantextract()on untrusted data, like user input (e.g.$_GET,$_FILES).$errors[] = 'Entre a comment';var_dump($comment);andvar_dump($author);?var_dump($author);gives me string(8) "nickname" andvar_dump($comment);returns string(10) "a comment "