My guess is you get a PHP error, which generates output before the headers are sent. If you have E_NOTICE
enabled, calling $_POST['foo']
may generate a "Notice: undefined variable" error if that variable is not set.
Best practice: never assume anything about GET, POST, COOKIE and REQUEST variables. Always check first using isset()
or empty()
.
if ( isset( $_POST['foo'] ) ) {
$foo = (string) $_POST['foo'];
// apply more sanitizations here if needed
}