Securing $_GET

[Eiolon]

Are there any tutorials on this?  Basically, I want to make it so people can't type in the URL to delete a record and whatnot.

 

Also, what are your thoughts on using $_SESSION instead of $_GET to navigate records?  For example, use $_GET to set the session and use the session thereafter to do the queries.

[dual_alliance]

You should use $_POST instead of $_GET as it is more secure.  But if you still want to use $_GET you should make it so that the script checks to see if the user via $_SESSION has permission then delete's a record.

 

Also it would also be wise to filter $_GET with htmlspecialchars()

[cooldude832]

You should use $_POST instead of $_GET as it is more secure. 

 

Wrong!

Get has the same security level as post, the moral of the story is you can't trust anything a user can touch you must check it all, period.

[dual_alliance]

I dont think it is a wise idea for any user to see the information that is being submitted to the database, such as a registration script this is why l consider $_POST to be more secure.

[cooldude832]

its not more secure, its an illusion really, post data can be modify, sure it takes additional steps, but still can be done.  The advantage to get over post is that a page can be chached or accessed through non conventional methods such as a hyperlink.  In generally you should always use post and when you find a strong advantage for get you use get.

[Psycho]

Who said anything about data that is being submitted to the database? The OP was asking about a delete function which, I presume, would accept a record id. The user would not typically know/care about the record IDs as they should not be customer facing.

 

But, cooldude is 100% correct. Any data submitted through POST or GET should be considered possibly malicious and must be properly validated and sanitized. Just as a user can enter data on the URL they may also create their own forms to post data.

[Eiolon]

So wait, you are saying I should use POST to RETRIEVE data?  How would I delete a record by using POST?  I thought I need to call the record id in order to delete it, hence I used GET.

[Eiolon]

Any data submitted through POST or GET should be considered possibly malicious and must be properly validated and sanitized. Just as a user can enter data on the URL they may also create their own forms to post data.

 

Yes, this is what I was referring to.  Is there any information on how to "validate and sanitize" the data?

[wsantos]

So wait, you are saying I should use POST to RETRIEVE data?  How would I delete a record by using POST?  I thought I need to call the record id in order to delete it, hence I used GET.

 

In some ways yes.

 

But, cooldude is 100% correct. Any data submitted through POST or GET should be considered possibly malicious and must be properly validated and sanitized. Just as a user can enter data on the URL they may also create their own forms to post data.

 

I agree and that's why for this situation I'll prefer using a combination of POST,Session, and encryption/decryption.

 

Yes, this is what I was referring to.  Is there any information on how to "validate and sanitize" the data?

 

There are many ways around this.

 

1. Data Level: don't ever use small digit id's as much as possible mask it.

2. I was thinking of use js to encrypt your data and get it so it will show in your url and in your source the encryption but use php to encrypt it using sessions.  Should be harder to crack rather than having straigh POST or straight Session.

[teng84]

TIP TOP TIPS EVERYONE LOl ... THIS IS SHORT BUT IMPORTANT>>>

 

never ever do this

 

$sql= "select * from table".$_POST[value];

y?

if my post or get is >>>  4; delete tablename;

$sql= "select * from table".$_POST[value];

it will select and delete your table

 

better to do this

$sql= "select * from table {$_POST[value]}";

in this case you will get sql error if you try the first value i posted..(4; delete tablename;)

 

and also try to always limit your query

so if ever he get your system hack he can only delete your records one by one not once in a row

 

DOES IT MAKE SENSE lol

 

[Wolphie]

When i insert data i always use escape strings and the sprintf() function.

 

e.g.

 

$password = mysql_escape_string(htmlspecialchars(MD5(MD5($_POST['password']))));

$sql = mysql_query(sprintf("INSERT INTO `users` ( `password` ) VALUES ( '%s' )", $password)) or die('Error: ' . mysql_error());

[emehrkay]

You can use get just fine. Just make sure that you clean the var before passing it to your DB. and you should wrap your delete functionality in a function/class/if that only certain level people can access