<?php
if ($access_level == "") {
echo '<option value="user"> User</option>';
echo '<option value="administrator"> Administrator</option>';
} elseif ($access_level == "administrator") {
echo '<option value="administrator" selected = "selected"> Administrator</option>';
echo '<option value="user"> User</option>';
} elseif ($access_level == "user") {
echo '<option value="administrator" > Administrator</option>';
echo '<option value="user" selected = "selected"> User</option>';
} else {
echo '<option value="user"> last one</option>';
echo '<option value="administrator" > Administrator</option>';
}
?>
<?php
if(isset($_POST["submit"])) {
$first_name = $_POST["first_name"];
$last_name = $_POST["last_name"];
$user_name = $first_name . "_" . $last_name;
$access_level = $_POST["access_level"];
$department = $_POST["department"];
$password = $_POST["password"];
$password2 = $_POST["password2"];
if ($password !== $password2) {
echo "Passwords do not match, please re-enter";
} else {
redirect_to("account_created.php");
}
} else {
$first_name = "";
$last_name = "";
$user_name = "";
$access_level = "";
$department = "";
$password = "";
$password2 = "";
$message = "Please log in";
}
<?php // RAY_temp_lb1234.php
error_reporting(E_ALL);
// USE TERNARY OPERATOR TO GET ACCESS LEVEL FROM REQUEST
$access_level = !empty($_GET['a']) ? (string)$_GET['a'] : NULL;
// SET DEFAULT VALUES TO NULL
$oa = $ou = NULL;
// CHOOSE AMONG COMPETING OPTIONS
switch (strtolower(trim($access_level)))
{
case "administrator" : $oa = ' selected '; break;
case "user" : $ou = ' selected '; break;
}
// USE HEREDOC TEMPLATE TO CREATE HTML FRAGMENT
$html = <<<EOD
<option value="user" $ou> User </option>
<option value="administrator" $oa> Administrator</option>
EOD;
// SHOW THE WORK PRODUCT
echo htmlentities($html);
To me the greater question is "can you trust the external variables?" and we do not see where they come from here, so the answer has to be "nope." I believe (without testing) that no matter what the external variables contain, the script will generate something that makes sense. Of course, I could be wrong if the external variable contained an 80GB object, or a floating point number or something goofy. :-)