I would not process a post like this....I would suspect an exploit is opened this way. Instead just change the $_POST to $_POST['form_elm_name'] where form_elm_name = the value of the forms name attribute. also do not trust the users input to be harmless. If the expected value of a form is a age, then check that the post only has numbers in it php is_numeric($_POST['form_elm_name']; if it is going to be text only then I usually include a custom function to remove all non-characters from the input. This funct only permits lowercase letters a dash and a space as valid. It alse swaps all spaces for a dash.
function clean_input($input)
{
$valid = array('a','b','c','d','e','f','g','h','i','j','k','l','m','n','o','p','q','r','s','t','u','v','w','x','y','z','0','1','2','3','4','5','6','7','8','9','-',' ');
$cnt = strlen($input);
$input = strtolower($input);
$output='';
for($i=0;$i<$cnt;$i++)
{
if(in_array($input[$i],$valid))
{
if($input[$i]==' ')
{
$output.='-';
}
else
{
$output.=$input[$i];
}
}
}
return $output;
}
