[SOLVED] Your way

[Dane]

Hey guys,

 

For errors such as mysite.com?id=1. If you only have 1 id and someone enters something other than that "1" would you header redirect or just exit();?

[rajivgonsalves]

Your question is not very clear, redirect exit what is the script doing ?

[Dane]

Well if someone trys a hacking attempt by entering something other than what needs to go into mysite.com?php=1/2/3/4 etc would u redirect them to the main url or just exit the script?

[rajivgonsalves]

if you do not have any sort of checking it would execute the script consider a editprofile.php script we pass editprofile.php?id=1 to edit the profile of userid 1 if someone enters editprofile.php?id=2 it will show up with userid 2 but if you check that the user logged in is userid 1 and check it against the input and then terminate the script

[trq]

would u redirect them to the main url or just exit the script?

 

This generally depends on how you want your application to look. Its usually pretty nasty to simply kill the script, leaving the client with no idea what happend.

 

I would more likely choose to redirect them to a nice message stating what the problem was.

[Dane]

ok thanks, ill use a bit of both depending.

[helraizer]

If there's only one ID then you should do something like :

 

<?php
if (!stristr($_SERVER['PHP_SELF'], "?id=1")) {
header ("Location: http://www.mysite.com/error.htm");
}
?>

 

-Or-

 

<?php
if (!stristr($_GET['id'],"1")) {
header ("Location: http://www.mysite.com/error.htm");
}
else {
//Your code for if the id is actually '1'
}
?>

 

That means if the id is anything but 1 it will redirect the user to the error message (as Thorpe suggested).

 

Sam

[revraz]

I redirect.

[Dane]

But what if HTML is outputted? Header wont work?

[trq]

If html is outputted you need to rethink your logic. All logical processing should happend prior to any output.

[Dane]

True, i will rework my code thanks

[revraz]

Nothing says you have to use Header, you can use HTML or Java to redirect as well.

 

But what if HTML is outputted? Header wont work?

[trq]

Nothing says you even need to redirect.

 

<?php

  if (isset($_GET['id'])) {
    $id = mysql_real_escape_string($_GET['id']);
    if ($result = mysql_query("SELECT * FROM foo WHERE id = '$id'")) {
      if (mysql_num_rows($result)) {
        // success page goes here.
      } else {
        // no records found page goes here.
      }
    } else {
      // query failed page goes here.
    }
  } else {
    // default page goes here.
  }

?>