Need to prevent people from changing the URL

[kevinak]

Well, this place has some amazing and helpful people, so I decided to stop back with this question.

 

I have a script that is set up to get information from my database based of the url.

 

The file would look like this for example  www.example.com/example.php/3

 

Now people are merely changing this number to access another page.

 

I need to prevent this since when they go to this page, then are rewarded. I set up a confirmation page before it, but I have no clue how to check if they went through the confirmation page or simply changed the URL, suggestions?

 

Thanks for reading.

[ThunderAI]

Although this wont really help you, my personal belief is NEVER pass anything in the URL....never.  When i can i pass things to sessions or if i have to POSTS.

[Fadion]

Although this wont really help you, my personal belief is NEVER pass anything in the URL....never.  When i can i pass things to sessions or if i have to POSTS.

 

That makes no sense. Never pass a url variable? Great, PHP (and all the other web scripting languages) should abandon GET support then...

 

As for the problem. Your url should be example.com?smth=3, or maybe you've mod_rewrite your urls. You can solve all this with a session. When someone enters the confirmation page, create a session for them. While they go in the reward page, check if the session is set and destroy it (so they don't re enter again without going to the confirmation page first). It should be easy, but if you need sample code, just ask.

 

 

[kevinak]

I think i'm understanding.. but a sample code would be amazing if you had a little free time.

 

Thank you for the responses.

 

Also, what exactly does the ? in the url do. I simply designed a function that gets the url, then explodes it into an array and using the array[4] to get the number that is placed in the url. Or is that like super novice, easy to hack kind of thing?

[revraz]

? is used in conjuction with $_GET, so a URL can be parsed and the variable after ? can be extracted

 

?id=1 would allow $_GET['id'] to be populated with the value 1

 

As for sessions, there are a ton of examples floating around.

[kevinak]

ah I see great example thank you.

 

So should I rework everything to add the get function?

Or is it really that bad to stick with a function that simply gets the number after the /?

 

Because, i've been running this on a LOT of different scripts and I have yet to find a single error.