CODEWITHSUNDEEP
phpsecurityobfuscation
Petrogad
Petrogad

Reputation: 4423

PHP Security when Passing MySQL Unique ID via Get

Lets say I have a website with links to various books on my main page.

<a href='books.php?id=1'>Book 1</a>
<a href='books.php?id=2'>Book 2</a>
<a href='books.php?id=4'>Book 3</a>

Books 1-3 are in my system, however id=3 is apart of another catelog that I'm not showing or authorizing through this section of the site. So if a user clicked on Book 3, then changed the id=4 to id=3, they could simply pull up the record (assuming I don't have proper session checking).

Is there a good way to obscure the get id that you're passing when trying to pull a specific record? it seems by passing just the id would be easy to request pages that, without proper querying and session checking, you would be able to get another result.

Is there a better way to do this?

Cheers

Upvotes: 0

Views: 463

Answers (5)

rpjohnst
rpjohnst

Reputation: 1642

You definitely need to check whether the user is allowed to view the page.
But, what if you separated the ids for the different catalogs? URL's could look like books.php?cat=foo&id=1. That wouldn't necessarily make things any more secure, but it would prevent people from accidentally finding the wrong pages and organize things a little better.

Upvotes: 0

dassouki
dassouki

Reputation: 6366

just thinking out loud:

  1. you can make a column in your book mysql table saying "visible" ... or userlevel in your users tables.

  2. do a php function or if statement that:

    if (user is not in user_level) // user is not allowed to see everything
{
    redirect to previous page;
}
else if (user is in user_level) // user is allowed to see everything
{        
    display all items;
}

Upvotes: 0

RaYell
RaYell

Reputation: 70424

You probably could hash your id or something using md5 or whatever to make it harder to manually enter, but that's really not a good idea.

What you should do is to implement server side security in your books.php script that will prevent users from unauthorized access. That's the only thing that will keep your site secure.

Upvotes: 1

Tyler Carter
Tyler Carter

Reputation: 61577

You need to always, always, check that user is able to access the page. That is the only way to verify that you don't show wrong data, because someone can always modify the link they are going to, even if you somehow hide it.

There is just no escaping it. You always need to verify that the record can be accessed.

Upvotes: 1

Andrejs Cainikovs
Andrejs Cainikovs

Reputation: 28464

Just check id if it is allowable to display or not.
With get's a good practice is when you check whatever parameters you may have.

Upvotes: 0

Related Questions