Url Injection Protection. Take it Seriously
Get your attention? Hope so. I got hacked severely by the most innocent means and wanted to share the outcome with you all. Little did I realize that by not validating url parameters VERY carefully somebody could do some serious damage including looking up passwords, etc.
The simple way I am now protecting my queries is with an INTVAL check.
When you do a lookup lets say website.com/news.php?id=1 I can ADD sql to the end of that 1 and do all kinds of things. Example;
website.com/news.php?id=1; Drop Table *
website.com/news.php?id=1; INSERT USERS *
Scary wouldnt you say? I am now using two means to protect pages that use an ID parameter. At the very start of my code I check the id as follows now;
!is_numeric($_GET['id'])
I its NOT a number, I kick them to my homepage. Why? They clearly messed with my url and dont really want to read my news. If its not a number, the news wont load, you get dumped.
As a secondary and redundant measure I also cleaned my query.
$colname_news = intval($_GET['id']);
WHERE id = %s", $colname_news
All I am doing here is converting the ID to a number. So if for WHATEVER reason my first check failed ( dont see how it could ) I convert the ID to an int before it goes into my query. That way if somebody did this;
website.com/news.php?id=1; INSERT USERS *
It would still only be 1. INTVAL drops the '; Insert users *'
Hopefully this helps somebody. I am by no means done my code improvements and am no expert. Feedback welcome.
