I'm reading "Essential PHP Security" by Chris Shiflett. on the very beginning, page 5 & 6, if I got it correct, he said this is not good: $search = isset($_GET['search']) ? $_GET['search'] : ''; and this is good: $search = ''; if (isset($_GET['search'])) { $search = $_GET['search']; } what's the difference? I really can't see? to me is more the way you like to write your code (and I like the top one :-) )? thanks. -ll __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com