Automatically unsetting submit values from $_POST + safety issue?

[eluser]xwero[/eluser]
it's very easy to post a form with tempered values and keys. There is even a developer firefox add-on that makes it possible to post a form.

The validation only picks up the fields you have added, it doesn't care about the other fields in the post array.

the isset check could be moved up, then you get this

Code:

if( ! in_array($field,$excluded_fields) && isset($_POST[$field]) )
{
   $insert[$field] = $_POST[$field];
}

It is better because then you only add the values that exist in the post field an not all fields in the post array.