title: Should i sanitize $_POST data if used in if statement?
body: <p>i am implementing a simple closed area on a website.
  The access is granted upon entering the right password. The password is shared so no real accounts are in place.
  I am trying to understand if i am missing some variable filtering and if i should sanitize the data. I'm pretty sure i must do it, but i don't know what is the best approach.</p>
  
  <p>In my code i have two places where i use the data from the $_POST variable:</p>
  
  <pre><code>if(isset($_POST)&amp;&amp;$_POST['the_password']!="")
  {
      $my_password = $_POST['the_password'];
      //Should i use something like this?
      //$my_password = filter_input(INPUT_POST, 'the_password', FILTER_SANITIZE_STRING); 
  }
  </code></pre>
  
  <p>The second place is where i use the variable, in an if statement:</p>
  
  <pre><code>if($a_password == $my_password)
  {
      //Query using the $a_password variable
  }
  </code></pre>
  
  <p>In this part of code $a_password comes from a hard coded query.</p>
  
  <p>Is the filter_input function the right one? Am i missing something?</p>