Is it safe to do smth like this in first if on the page ctype_digit(base64_decode(trim($_POST['id'])
or i should first create variable inside if and assign trim($_POST['id']
) to it because they might have put some crazy thing in it that might overflow base64_decode
or ctype_digit
for example or i am overemphasizing?
I would say that you are being careful enough by doing that. However, in most cases the correct way to code would be to create a variable, like $id, and assign it the value of your post variable. This is because allot of developers have to work with templates, and as a PHP programmer your task would be to take post / get input and database rows, and make them available to templates as easy to access variables and arrays.
Your example makes your script safe when you are expecting a numerical id. If you are expecting a string, usually to be used in an SQL statement, then you will need to take further steps. Even the cleanest string can be used for SQL injection. That's where prepared statements should be used.
I don't really get your question I'm afraid. Simply assigning $_POST['id'] to a variable before applying the 3 functions to it would not make any difference. However, you should first validate that $_POST['id'] is actually set (or you'll get a notice) and you should always validate that the incoming data (value in $_POST['id']) is actually valid (and can not induce attacks if it contains a malicious value) before using it.
If you are afraid of huge data inputs just add an strlen before you decode it, in that way you won't need to worry about overflowing it. And you should always check the data before using in near a database.