CODEWITHSUNDEEP
phpurlexceptionget
iamjonesy
iamjonesy

Reputation: 25122

PHP: managing url $_GET tinkering

Here's a situation, i have a list of support tickets that when you click the title of the ticket takes you to a page that displays the ticket in more detail. If uses URL GET variables to query the database. I've taken SQL injection into account but what if someone modifies the url to an id that doesn't exist? whats the best way to deal with that?

Thanks,

Jonesy

Upvotes: 1

Views: 247

Answers (5)

nana
nana

Reputation: 4481

You should always check if your query returned anything. If it returned 0 rows, the ID doesn't exist.

<?php

$result = mysql_db_query("your query", $link);
$num_rows = mysql_num_rows($result);

if($num_rows < 1) {
  // row with that id doesnt exist
  // do whatever you want
} elseif($num_rows > 1) {
  // you have problem with your ids in db
} else {
  // everything went fine
  // do your thing here
}

?>

Upvotes: 1

Evan Mulawski
Evan Mulawski

Reputation: 55334

This may seem too simple, but you should always validate your GET (or POST) variable before doing anything with them. In your case, just verify that the ID exists in the database. If it doesn't, inform the user.

Upvotes: 1

norwebian
norwebian

Reputation: 820

You probably have to make a page handling unsuccessful searches anyway; just route it in there. Then you can help the user to find what (s)he searches in a consistent way, provide cues and "most-searched-after" and what not.

Upvotes: 3

Piskvor left the building
Piskvor left the building

Reputation: 92752

Check if the ticket exists; if not, react accordingly. What "react accordingly" means is determined by your business logic: create a new ticket? raise an error? take the user to a list of available tickets?

An example using the old mysql extension for brevity: 

$sanitized_numeric_id = (int) $_GET['ticket_id']; // assuming id is numeric
$query_resource = mysql_query('SELECT `somecolumn`, `column2`, `othercolumn` 
                                  FROM `tickets`
                                  WHERE `id`= ' . $sanitized_numeric_id);
if (mysql_num_rows($query_resource) > 0) {
    // the ticket exists, do something with it
} else {
    // the ticket doesn't exist, react accordingly
}

Upvotes: 0

Gordon
Gordon

Reputation: 316959

If the ID does not exist, send a 404 - Not Found header along with a nice error page telling the user that it wasn't found.

Upvotes: 5

Related Questions