validation - what does it mean to only allow expected input in php? -

i'm reading book on php security, , on input validation chapter there's small section talks allowing expected input.

this code show:

<?php $expected = array( 'carmodel', 'year', 'bodystyle' ); foreach( $expected $key ) { if ( !empty( $_post[ $key ] ) ) { ${$key} = $_post[ $key ]; } else { ${$key} = null; } } ?> 

i'm kind of confused, there's small paragraph explains code does. assigns value array key $_post. says array should done programatically copied out of gpc array.

what don't understand in cases should use this? , gpc array?

the code creates variables data in $_post array. names of variables taken keys of $_post array. php calls (i.e. naming variables dynamically) variable variables.

this bad idea, because not control, keys present in $_post array, , thus, variables created. user of website controls this. malicious user might name post variables in such way overwrite variables intended different purposes.

the book suggests allow keys in $_post array overwrite variables in controlled manner. that's $expected = array('carmodel', 'year', 'bodystyle') for. , following code creates variables $carmodel, $year , $bodystyle. if, example, user posts current_user_has_admin_rights=1 application, variable $current_user_has_admin_rights value of 1 not created.

my suggestion to stay away variable variables alltogether , instead access post values through $_post array only. makes clear value comes from, makes easier spot if such value handled in unsecure manner.