CODEWITHSUNDEEP
securitycodeignitercontroller
FlyingCat
FlyingCat

Reputation: 14260

How to secure the segment passed to the controller in CI

I am trying to pass a segment to a controller. The url is like base_url/controller/function/seg1. I want to ensure that if the user try to enter the segment in the address bar, the controller would make sure there are not other words to be proceeded except the segment I want to pass.

For example, If the user tries to type base_url/main/function/(change this to other words) in address bar, the controller will filter the segment. I am not sure how to do it and would appreciate if someone can help me out.

Upvotes: 0

Views: 32

Answers (2)

Skittles
Skittles

Reputation: 2918

Okay, so the best way to "secure" against such things would be to simply create a session at the time the user logs into your site with two values stored in that session;

1) Their database primary key id, and 2) a session item called 'logged_in'

At the time that your user would log into your site, you would store those two values like this;

$this->session->set_userdata('logged_in', true);
$this->session->set_userdata('user_id', $id);

Where $id is pulled from their user record during authentication.

Now that you have those in there, the next part would be that, in your controller, you would put an if statement in that checks if the user is logged in, as such;

function show($id) {
  if($this->session->userdata('logged_in')) {
    $posts = $this->Model_posts->get_user_posts($id);
  }
}

Now, in your model, you would create a function for pulling the record that you want the user to be able to view based on their user_id. We'll say user posts for example.

function get_user_posts($user_id, $post_id) {
   $sql = "SELECT * FROM posts WHERE user_id = ? AND id = ?";
   $binds = array($user_id, $post_id);
   $qry = $this->db->query($sql, $binds);
   $result = array();

   while($row = $qry->result_array()) {
     array_push($result, $row);
   }
   return $result;
}

Now, when a logged in user or visitor tries to access records that don't belong to them, they will not retrieve any records because the select statement limits what's returned only to that user.

Upvotes: 1

Skittles
Skittles

Reputation: 2918

The structure you have there is

base_url/controller/action

So, your controller is already "filtering" it out because if you don't have a method/function in the controller (methods = actions) then your controller will trigger a 404 Page Not Found error. Of coarse, you could then handle your errors however you see fit, but from what you presented, the item you wish to filter is known as a controller action.

So for instance;

http://www.base_url.com/users/add

denotes that you wish to call the add (function) in the users controller.

If you want to pass the add action an argument, then you would do this as;

http://www.base_url.com/users/show/1

Where show would be a controller action and 1 would be the id of the user you wish to show. I know it seems like I'm giving a basic intro to MVC methodologies, but like I said, the structure you showed plays out like I described.

Hope this helps.

Upvotes: 1

Related Questions