1

Im learning about validating form input data and there was this bit of code on w3schools that i don't understand. see below:

<?php
// define variables and set to empty values
$nameErr = $emailErr = $genderErr = $websiteErr = "";
$name = $email = $gender = $comment = $website = "";

//bla bla bla

i dont understand what "// define variables and set to empty values" means.

babyleans
  • 23
  • 2
  • 9
  • 4
    To mkake sure those variables are always defined even though their values may never changed. It prevents errors and warnings that nay otherwise occur if someone tried to use them before they are defined. – John Conde Sep 22 '14 at 18:55
  • It means to initiate all the variables to empty value. So when you try to access those variables you don't get undefined variable notice. – yajakass Sep 22 '14 at 18:55
  • Although note that there are functions like `isset()` that can help you. Either way, sometimes you just want to create the variable, without immediately assigning it with a value (for instance, in the global scope). – Max Sep 22 '14 at 18:56
  • Thank you guys! So should i always do this with all my variables? – babyleans Sep 22 '14 at 19:01
  • @babyleans No, you shouldn't really do this at all. It's a pointless practice, and you wouldn't want to initialize variables with an empty string anyway. Can you provide a link to the W3Schools page so I can see the context and provide an explanation for what they're doing? – Brad Sep 22 '14 at 19:02
  • @Brad ok. here is the link http://www.w3schools.com/php/php_form_url_email.asp at the bottom of the page is where you'll find all the code – babyleans Sep 22 '14 at 19:10

1 Answers1

2

Don't use this tutorial. I'm looking at this test_input() function and can't believe that someone would publish this code:

function test_input($data) {
  $data = trim($data);
  $data = stripslashes($data);
  $data = htmlspecialchars($data);
  return $data;
}

See my answer here for more information on why this is a bad idea, and what to do instead: https://stackoverflow.com/a/7810880/362536

Now, on to your actual question. In many languages, you are required to declare what variables you are going to use before you use them. PHP is not one of these languages. Some people think that your code is easier to read if you know what all the variables are up front, and will define these variables as a matter of code style. That is, they will list variables and set them to some value. The code you have:

$nameErr = $emailErr = $genderErr = $websiteErr = "";

... is functionally equivalent to:

$nameErr = '';
$emailErr = '';
$genderErr = '';
$websiteErr = '';

In PHP, you can chain your variable assignments, which is why these two are equivalent.

If you choose to declare your variables as a matter of style, you should not assign an empty string to them. You should use null instead. Suppose I have a variable that is conditionally assigned data from a user input field. If I use empty string '' to initialize variables, I have no way of knowing if the form field existed and was submitted or not. If I use null, I can then use isset() to determine if the variable has an empty form field (empty string '') or null as its value.

You may very well decide that empty string initialization is right for your application. As John Conde says in the comments above, many folks use this so they can freely concatenate variables without worrying about what's in them, as even if they don't get an explicit value assigned, you already assigned an empty string. I would argue that there is rarely a time when you will work with data that always maintains a single purpose throughout it's lifetime, and that it's best to have data in the cleanest representation as possible. If a variable is intended to be null, its value should indeed be null and not an empty string. What you choose is up to you and your specific circumstances.

Community
  • 1
  • 1
Brad
  • 159,648
  • 54
  • 349
  • 530
  • thank you for the warning but i cant see that exact bit of code in the w3schools link. what were they trying to achieve? – babyleans Sep 22 '14 at 23:13
  • @babyleans It was on an earlier page in that tutorial: http://www.w3schools.com/php/php_form_validation.asp All of those escaping methods are often naively used as a way towards security. It must be remembered though that none of those methods are useful except when used in the correct context. Adding slashes does nothing but muddy up your data. Escaping for HTML prior to when you need to use it in HTML just means that you can't use your data in any other context. And `trim()`... it has its uses, but don't blindly trim every field. Only trim where necessary. – Brad Sep 22 '14 at 23:22
  • ok thank you! i'm very new to form input validation, is there a messaging feature here if i need to contact you? – babyleans Sep 22 '14 at 23:29
  • @babyleans Just post any specific questions you have on Stack Overflow, and someone will answer them. Do search first though, as many of those sorts of questions have been answered already. – Brad Sep 22 '14 at 23:48