Using $_REQUEST
is a bad practice. Between post
requests, get
requests, and cookies you can not be certain that you are processing actual user input and not some garbage left in the URL or in the browser’s memory.
Meta boxes are “posted” so use only $_POST
when processing them.
The other aspect of your code is that you are trying to access things which are not belonging to “your code”. Always prefer to use whatever API there is for that instead of trying to access them from global places. While I do not see any reason why would anyone do it, someone at some point will probably have a great idea of removing some values from $_POST
because of some imaginary (or less imaginary) reason. In addition APIs like save handlers will be called to handle “saves” which were not originated from a browser at all, at which case those global variables might be empty or contain garbage.
Ohhhhhhhhhhhhh you are using names for your fields which are not prefixed in any way. It is a big can of worms by itself. Always prefix everything which is in global scope.