title: Best practices in PHP using $_POST and $_GET variables
body: <p>Considering a project where will work more than one developer and that will receive constant update and maintenance, what of the two codes below can be considered the best practice in PHP, considering Readability and Security? If we talk in performace, <a href="https://developers.google.com/speed/articles/optimizing-php" rel="nofollow">the second option will probably be a little better</a>, but there are ways to solve this point.</p>
  
  <p><strong>Option 1</strong></p>
  
  <pre><code>$user = $_POST['user'];
  $pass = $_POST['pass'];
  
  // Prevent SQL Injection and XSS
  $user = anti_injection($user);
  $pass = anti_injection($pass);
  
  if(strlen($user) &lt;= 8 &amp;&amp; strlen($pass) &lt;= 12)
  {
      // SQL query
      $sql = "SELECT id 
              FROM users 
              WHERE username = '$user' AND password = '$pass';";
  }
  </code></pre>
  
  <p><strong>Option 2</strong></p>
  
  <pre><code>// Retrieve POST variables and prevent SQL Injection and XSS
  $_POST['user'] = anti_injection($_POST['user']);
  $_POST['pass'] = anti_injection($_POST['pass']);
  
  if(strlen($_POST['user']) &lt;= 8 &amp;&amp; strlen($_POST['pass']) &lt;= 12)
  {
      // SQL query
      $sql = "SELECT id 
              FROM users 
              WHERE username = '" . $_POST['user']. "' AND password = '" . $_POST['pass'] . "';";
  }
  </code></pre>
  
  <p><strong>EDIT 1</strong> </p>
  
  <p>I am not using MySQL, my database is PostgreSQL</p>