Is this a reliable way to access options from a select element in PHP?
<p>I have this select input in my form that I want to access via PHP.</p>

<pre><code>&lt;div data-role='fieldcontain'&gt;
    &lt;label for='fruits' class='select'&gt;Favorite Fruits&lt;/label&gt;
    &lt;select name='fruits[]' id='fruits' multiple='multiple' data-native-menu='false'&gt;
        &lt;option value=''&gt;Favorite Fruits&lt;/option&gt;
        &lt;option value='1' selected='selected'&gt;Apple&lt;/option&gt;
        &lt;option value='2' selected='selected'&gt;Banana&lt;/option&gt;
        &lt;option value='3' selected='selected'&gt;Cherry&lt;/option&gt;
    &lt;/select&gt;
&lt;/div&gt;
</code></pre>

<p>By setting the name of the select element to "fruits[]", this works:</p>

<pre><code>// |$fruits| is an array
$fruits = $_POST['fruits']
</code></pre>

<p>However, I am concerned about cleaning data from the form. Feeding post data into an array sounds insecure. What if, for instance, someone changes the select element into a text input element via Firebug and inputs malicious code into my program? I never call <code>htmlspecialchars</code>.</p>

<p>Are my security concerns valid? Why or why not?</p>
