CODEWITHSUNDEEP
phpcode-injection
AAA
AAA

Reputation: 3168

How to prevent user generated faults?

i am new to PHP so don't know how this would turn out. Lets say i have a add friend page. And in the database lets say i have a table called "friends" and the following rows: my_id and friend_id and id_request.

And now i have a php page that will look something like: addfriend.php?id=friendid

And then i use the id from that link to insert in to the database my id and that friendid.

The question is what will happen if someone enters "kdjfkldjlfk" in the link in the address bar?

Upvotes: 0

Views: 48

Answers (4)

webbiedave
webbiedave

Reputation: 48887

It turns out that PHP has some pretty cool filter functionality built-in. You should learn them and use them:

if (filter_var($_GET['id'], FILTER_VALIDATE_INT) === false) {
    // error
}

if (filter_var($_GET['email'], FILTER_VALIDATE_EMAIL) === false) {
    // error
}

if (filter_var($_GET['ip_address'], FILTER_VALIDATE_IP, FILTER_FLAG_IPV4) === false) {
    // error
}

http://us.php.net/manual/en/function.filter-var.php

Upvotes: 1

Bojangles
Bojangles

Reputation: 101543

You need to validate your user input. First, cast the $_GET value to an int type, and if it's equal to 0, tell them they've mistyped it.

$var = (int)$_GET['id'];

if($var == 0)
{
    // Error
}
else
{
    // The rest of your code
}

Upvotes: 1

Quentin
Quentin

Reputation: 944474

If you mean "What will happen if someone visits the URI for an id that does not exist?", then it depends on what your PHP says should happen.

If your PHP doesn't check how many results it got from its SQL query, then it is quite possible that the page will spit out a 500 Internal Server Error.

If you've designed it properly, then it would return a document that explains that you cannot add a user that does not exist as a friend.

Actually, if you've designed it properly then the data should be sent via POST not GET since adding a friend is not an idempotent event. (See the HTTP specification — GET should be free of side effects)

Upvotes: 1

Tarek
Tarek

Reputation: 3798

you need to prevent those cases and validate

ex:

test that the $_GET['id'] isset and that the friendid is real , you could query the database to see that the id exists ...

Upvotes: 1

Related Questions