title: Escaping variables in an array and assigning escaped values to original variables value dynamically
body: <p>I normally just use <code>mysql_real_escape_string</code> on every variable before inserting to my database, so for example:</p>
  
  <pre><code>    $first_name = mysql_real_escape_string($first_name); // Bill
      $last_name  = mysql_real_escape_string($last_name);  // O'Rielly
      $email      = mysql_real_escape_string($email);      // name@domain.com
  
      $insert = mysql_query("
                    INSERT INTO `users` (first_name, last_name, email)
                    VALUES ('$first_name', '$last_name', '$email')
                ") or die(mysql_error());
  </code></pre>
  
  <p>But on some forms I could have possibly 20 different variables I want to escape, so I was hoping there was a way I could use an array, run it through a function to escape each one. Then make the original variables (<code>$first_name</code>, <code>$last_name</code>, <code>$email</code>) have the value of the escaped string from the array. I came up with the following, but this is as far as I have gotten.</p>
  
  <pre><code>    $form_array = array($first_name, $last_name, $email);
  
      print_r($form_array);
      echo("&lt;br /&gt;".$last_name."&lt;br /&gt;");
  
      function cleanInput($array) {
          return array_map('mysql_real_escape_string', $array);
      }
  
      $clean_array = cleanInput($form_array); 
  
      print_r($clean_array);
      echo("&lt;br /&gt;".$clean_array[1]."&lt;br /&gt;");
  </code></pre>
  
  <p>Which outputs the following:</p>
  
  <pre><code>    Array ( [0] =&gt; Bill [1] =&gt; O'Rielly [2] =&gt; name@domain.com ) 
      O'Rielly
      Array ( [0] =&gt; Bill [1] =&gt; O\'Rielly [2] =&gt; name@domain.com ) 
      O\'Rielly
  </code></pre>
  
  <p>So, we can see that it's escaping properly, but I'm stumped with the whole making <code>$first_name</code> have the value of <code>$clean_array[0]</code>, <code>$last_name</code> have the value of <code>$clean_array[1]</code> etc.</p>
  
  <p>I know of course I could just write:</p>
  
  <pre><code>    $first_name = $clean_array[0];
      $last_name = $clean_array[1];
  </code></pre>
  
  <p>But it kinda makes it pointless of having this array/function there at all since I might as well just escape each variable/string separately how I always have done. So I was hoping there was a way I could do some sort of loop in the function to do this dynamically depending on what's in the array.</p>
  
  <p>Because then when it comes to doing validation in the future I can just</p>
  
  <ul>
  <li>Assign all $_POST data to variables</li>
  <li>Put them variables in an array</li>
  <li>Run the array through the function and all original $_POST variables now have the escaped value from the function</li>
  <li>Use the insert method mentioned at the start using the original names of the variables <code>$first_name</code>, <code>$last_name</code> etc.</li>
  </ul>
  
  <p>Rather then:</p>
  
  <pre><code>    $insert = mysql_query("
                    INSERT INTO `users` (first_name, last_name, email)
                    VALUES ('$clean_array[0]', '$clean_array[1]', '$clean_array[2]')
                ") or die(mysql_error());
  </code></pre>
  
  <p>Is this possible?</p>
  
  <p><strong>Update</strong></p>
  
  <p>From hakre's post about the <code>compact</code> and <code>extract</code> functions, I've now come up with the following:</p>
  
  <pre><code>    $array = compact(array("first_name", "last_name", "email"));
      echo("&lt;strong&gt;Before:&lt;/strong&gt;&lt;br /&gt;First Name: ".$first_name."&lt;br /&gt;Last Name: ".$last_name."&lt;br /&gt;Email: ".$email."&lt;br /&gt;&lt;br /&gt;");
  
      extract(array_map('mysql_real_escape_string', $array), EXTR_OVERWRITE);
      echo("&lt;strong&gt;After:&lt;/strong&gt;&lt;br /&gt;First Name: ".$first_name."&lt;br /&gt;Last Name: ".$last_name."&lt;br /&gt;Email: ".$email."");
  </code></pre>
  
  <p>Which outputs the following details how I would like them:</p>
  
  <p><strong>Before:</strong></p>
  
  <p>First Name: Bill</p>
  
  <p>Last Name: O'Rielly</p>
  
  <p>Email: name@domain.com</p>
  
  <p><strong>After:</strong></p>
  
  <p>First Name: Bill</p>
  
  <p>Last Name: O\'Rielly</p>
  
  <p>Email: name@domain.com</p>
  
  <p>I've tried putting <code>extract</code> into a function but it doesn't work the same?</p>
  
  <pre><code>    function cleanInput($array) {
  
          $clean_array = extract(array_map('mysql_real_escape_string', $array), EXTR_OVERWRITE);
          return $clean_array;
  
      }
  
      $array = compact(array("first_name", "last_name", "email"));
      echo("&lt;strong&gt;Before:&lt;/strong&gt;&lt;br /&gt;First Name: ".$first_name."&lt;br /&gt;Last Name: ".$last_name."&lt;br /&gt;Email: ".$email."&lt;br /&gt;&lt;br /&gt;");
  
      cleanInput($array);
      echo("&lt;strong&gt;After:&lt;/strong&gt;&lt;br /&gt;First Name: ".$first_name."&lt;br /&gt;Last Name: ".$last_name."&lt;br /&gt;Email: ".$email."");
  </code></pre>
  
  <p>I'm sure I have to return the extract function, but I've tried a few different things and it's either not giving any output or <code>$last_name</code> is just printing the unescaped value.</p>