Tycoon Talk
Become a Big fish!
The number 1 forum for online business!
Post topics, ask questions, share your knowledge.
Tycoon Talk is part of Freelancer.com - find skilled workers online at a fraction of the cost.

PHP Forum


You are currently viewing our PHP Forum as a guest. Please register to participate.
Login



Freelance Jobs

Reply
passing parameters in the URL
Old 11-02-2008, 04:51 PM passing parameters in the URL
UCDaZ's Avatar
Skilled Talker

Posts: 80
Name: Nick Leung
Location: Silicon Valley
Trades: 0
In my url i'm passing parameters like
www.myexample.com/sample.php?BusinessId=5
The 5 in this case is the primary key of the database table "business."
Should I hash the "5" or is it ok to tell the world the primary key id?
Are there any security issues I should worry about?
Thanks!
UCDaZ is offline
Reply With Quote
View Public Profile Visit UCDaZ's homepage!
 
 
Register now for full access!
Old 11-03-2008, 03:07 AM Re: passing parameters in the URL
JeremyMiller's Avatar
WT Moderator

Posts: 1,712
Name: Jeremy Miller
Location: Las Vegas, NV
Trades: 0
That should be fine depending on other, un-named aspects of your program. Hashing isn't necessary. Sanitizing your data, however, is necessary.

PHP Code:
$business_id = (int)$_GET['BusinessId']; 
__________________
Jeremy Miller

Please login or register to view this content. Registration is FREE
JeremyMiller is offline
Reply With Quote
View Public Profile Visit JeremyMiller's homepage!
 
Old 11-03-2008, 04:15 AM Re: passing parameters in the URL
UCDaZ's Avatar
Skilled Talker

Posts: 80
Name: Nick Leung
Location: Silicon Valley
Trades: 0
But can't some hacker write a scrapper by incrementing the id's?
For loop from BusinessId 1...1000
UCDaZ is offline
Reply With Quote
View Public Profile Visit UCDaZ's homepage!
 
Old 11-03-2008, 04:42 AM Re: passing parameters in the URL
jito's Avatar
MY LIFE IS 'i' LIFE

Posts: 565
Name: surajit ray
Location: inside the heart of my friends
Trades: 0
Yes there is security issues. Try URL rewrite to hide it, you can hash it( but do you really need that! ask yourself), or you can check the id with a given range ... if you are displaying data based on that id.
__________________
I am not smart, that's why i don't act smart


Please login or register to view this content. Registration is FREE
jito is offline
Reply With Quote
View Public Profile
 
Old 11-03-2008, 01:59 PM Re: passing parameters in the URL
JeremyMiller's Avatar
WT Moderator

Posts: 1,712
Name: Jeremy Miller
Location: Las Vegas, NV
Trades: 0
Security is rarely achieved by obfuscation. Authenticate properly if you don't want people accessing a page. Hashing isn't the correct solution b/c then anybody who has the URL will be able to access it. Make them login if you don't want it public.
__________________
Jeremy Miller

Please login or register to view this content. Registration is FREE
JeremyMiller is offline
Reply With Quote
View Public Profile Visit JeremyMiller's homepage!
 
Reply     « Reply to passing parameters in the URL
 

Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Trackbacks are Off
Pingbacks are Off
Refbacks are Off





   
RSS Feed  Feeds: RSS   JS   XML
RSS Feed  Feeds for this forum: RSS   JS   XML



Page generated in 0.42386 seconds with 12 queries