klotto Posted February 22, 2009 Share Posted February 22, 2009 Hi everyone, I'm currently trying to build my first site with php. I use $_GET[] variables to pass certain values to mysql_query, which works perfectly. I have absolutely no idea, however, how to avoid situations when my URL is modified by accident or on purpose after "/somename.php?"...Currently it just messes up my whole query...Can anyone tell how I can avoid this? Thanks p.s. please keep in mind that I'm new to php... Link to comment https://forums.phpfreaks.com/topic/146311-passing-variable-from-url-to-php-mysql-script/ Share on other sites More sharing options...
Cosizzle Posted February 22, 2009 Share Posted February 22, 2009 hmm theres not you can do about that I dont think? Anyone messing around with their URL is a. trying to do some sort of sql injection or b. and idiot... The URL is for the browser, leave the navigation to your page. There are ways to mask the URL I think... but again - why? Sorry if im missing the point here hehe Link to comment https://forums.phpfreaks.com/topic/146311-passing-variable-from-url-to-php-mysql-script/#findComment-768132 Share on other sites More sharing options...
klotto Posted February 22, 2009 Author Share Posted February 22, 2009 I'm more worried about someone who by accident deletes, let's say, one letter in my URL and sees a messed up page...I was looking at some websites to see what happens if I delete a letter or two on purpose in their URL. For example, in http://www.facebook.com/home.php#/home.php?tab=3, no matter what I delete after .php?, I'm getting the same page. In situation like this on my site I'll receive an error message, since if, let's say, I used $_GET["tab"] is my query, it won't be available when somebody deletes a letter from "tab" making it "ab"...I hope it makes some sence ))... hmm theres not you can do about that I dont think? Anyone messing around with their URL is a. trying to do some sort of sql injection or b. and idiot... The URL is for the browser, leave the navigation to your page. There are ways to mask the URL I think... but again - why? Sorry if im missing the point here hehe Link to comment https://forums.phpfreaks.com/topic/146311-passing-variable-from-url-to-php-mysql-script/#findComment-768144 Share on other sites More sharing options...
Recommended Posts
Archived
This topic is now archived and is closed to further replies.