Before giving response to your inquiries, please allow me to point out problem on your codes that needs to be fix immediately.
We must not use $_REQUEST when processing form data from user. The reason is that $_REQUEST is like a garbage disposal it will process "post" and "get" $_SERVER['REQUEST_METHOD']. We want to be more specific on which one to use. e.g. post or get.
Most hackers are focusing on PHP's superglobal variables vulnerabilities. To make the matter worse, your script is using $_REQUEST.
Although the link I have provided above is somewhat focused on the session exploits.
I wish I could explain this topic in great detail, but due to time constraint, I wrote a simple function for you to experiment and observe the behavior of the form processor with $_REQUEST.
In my humble opinion $_REQUEST is a lazy tool for a lazy developer. A developer who is lazy to define the appropriate method for the from processor.
Let's prove that your code will fail. Create a new file formtest.php
<?php
function adaptive_form($method)
{
$form ='<form method="'. $method .'" action="">
<input type="text" name="name"/>
<br/>
<input type="password" name="pass"/>
<br/>
<input type="submit" name="submit" value="submit"/>
</form>';
return $form;
}
if(isset($_REQUEST['submit'])){
echo $_REQUEST['name'];
echo '<br/>';
echo $_REQUEST['pass'];
}
## call the function above with different params
echo '<br/>';
//echo adaptive_form('');
//echo adaptive_form('get');
echo adaptive_form('post');
Uncomment one at a time and test by directing your browser to formtest.php
//echo adaptive_form('');
//echo …