Menu
OK consider this url:
example.com/single.php?id=21424
It's pretty obvious to you and i that the PHP is going to take the id and run it through a mysql query to retrieve 1 record to display it on the page.
Is there anyway some malicious hacker could mess this url up and pose a security threat to my application/mysql DB?
Thanks
583
PHP $_GET is a PHP super global variable which is used to collect form data after submitting an HTML form with method="get". $_GET can also collect data sent in the URL. When a user clicks on the link "Test $GET", the parameters "subject" and "web" are sent to "test_get.
The parameters from a URL string can be retrieved in PHP using parse_url() and parse_str() functions. Note: Page URL and the parameters are separated by the ? character. parse_url() Function: The parse_url() function is used to return the components of a URL by parsing it.
POST is more secure than GET for a couple of reasons. GET parameters are passed via URL. This means that parameters are stored in server logs, and browser history.
Of course, never ever ever consider a user entry (_GET, _POST, _COOKIE, etc) as safe.
Use mysql_real_escape_string php function to sanitize your variables: http://php.net/manual/en/function.mysql-real-escape-string.php
About SQL injections : http://en.wikipedia.org/wiki/SQL_injection
75
If you love us? You can donate to us via Paypal or buy me a coffee so we can maintain and grow! Thank you!
Donate Us With
