CODEWITHSUNDEEP
phpsecuritypostget
Orahmax
Orahmax

Reputation: 2341

How to add security while using GET and POST method?

I developed a small application Contact Manager and while updating the contacts, the contact id is being sent using GET method. But a user can change the Id and edit any contact, how can i add security to it?

<td>
    <a href="home.php?action=update&amp;contactid=<?php echo $contact->contact_id; ?>">Update</a>
</td>

http://localhost/contmanager/home.php?action=update&contactid=1

If i change the id to some other number, another contact will show up.

Upvotes: 2

Views: 1949

Answers (3)

One Man Crew
One Man Crew

Reputation: 9578

You need to use session and to store the data inside like this:

<?php
    session_start();
    $_SESSION['contact_id']=$contact->contact_id; 
    <td><a href=home.php?action=update&amp;">Update</a></td>
?>

use it like this:

http://localhost/contmanager/home.php?action=update

and when you need to use contact_id(after the GET) :

session_start();
if(isset($_SESSION['contact_id']) && !empty($_SESSION['contact_id'])){
   $contact_id=$_SESSION['contact_id'];
  
}

A PHP session variable is used to store information about, or change settings for a user session. Session variables hold information about one single user, and are available to all pages in one application.

PHP Session Variables

When you are working with an application, you open it, do some changes and then you close it. This is much like a Session. The computer knows who you are. It knows when you start the application and when you end. But on the internet there is one problem: the web server does not know who you are and what you do because the HTTP address doesn't maintain state.

A PHP session solves this problem by allowing you to store user information on the server for later use (i.e. username, shopping items, etc). However, session information is temporary and will be deleted after the user has left the website. If you need a permanent storage you may want to store the data in a database.

Sessions work by creating a unique id (UID) for each visitor and store variables based on this UID. The UID is either stored in a cookie or is propagated in the URL.

Upvotes: 2

Mr. Alien
Mr. Alien

Reputation: 157334

As Quentin pointed out, your logic is going wrong here, data like these should be stored inside sessions and shouldn't be passed using $_GET or $_POST, unless and until required, if you still need to pass for some reason, than you can read my answer ahead for a solution.

Store the user id in a session, so when the user updates, just compare the session id and $_GET id, if it matches, update the entry else throw an error.

When the user logs in

$_SESSION['user_id'] = $db_data['col_name'];

Now, before the entry is updated...

if(!empty($_GET['user_id'])) {
  //First validate, you can check whether the id is only numeric, is valid db entry etc
  $user_id = $_GET['user_id']; //Store the id in a variable
} else {
  //Invalid
}


if($_SESSION['user_id'] == $user_id) { //Compare the ids
  //Process
} else {
  //Not Valid
}

Note: Make sure you use session_start() at the very top of the page, before you start writing anything.

Upvotes: 2

Quentin
Quentin

Reputation: 943560

You can't control what the client asks the server to do.

If you want to add restrictions on who can modify particular contacts then you need to Authenticate (username + password, client SSL cert, OpenID, etc) users and then check if they are Authorized (this will depend on the business logic you decide on) to modify the entry in question.

Upvotes: 4

Related Questions