1

I have a url like this (that you need to be logged in to see): https://www.example.com/form.php?id=268

form.php is for users to update details on a particular db entry (in this case id 268)

The application basically gets the id no, validates and sanitises it, runs a mysql query and then fills the form out with the results of the query.

In the query I use the id from the url plus a session variable $_SESSION['company_id'], which is set at login. That means if a user manually changes the url to (for example) ?id=269 he / she will only be able to see the details of id 269 if the company_id matches that of the company_id set in the session variable.

I'm confident that the url id will be OK / safe, but the session variable worries me. I'm not performing any IP or user agent checks on the session variable before I run the mysql query, which makes me feel a tad exposed. So...

  1. Do you think I should encrypt $_SESSION['company_id'] for extra security?
  2. Do you think it is worth running a user agent check before running the query? Does this add any security value?

--

Update

Have rewritten the question and title to try and be more specific

10
  • 3
    Your first big no-no is generating SQL queries like that; you're opening yourself up to injection attacks. Use prepared statements. Dec 28, 2011 at 19:40
  • 1
    You also need to sanitize & validate the input. In this case, it should be easy to make sure the ID is a valid int.
    – MrGlass
    Dec 28, 2011 at 19:45
  • I escape the the get $id = mysqli_real_escape_string($link, $_GET['id']) which helps
    – gelviis
    Dec 28, 2011 at 19:46
  • 1
    This isn't really a suitable question for SO; you're basically asking "suggest some security techniques to me"... Dec 28, 2011 at 19:48
  • Cheers Oli - can see what you mean. Will look at rewording.
    – gelviis
    Dec 28, 2011 at 19:59

2 Answers 2

1

There is no way to read or modify $_SESSION variables without PHP doing it for you, so I find no reason that you should encrypt them. Since this question seems to be mostly about personal opinion or techniques for security, this is what I'd do:

  1. I don't know why, but whenever I see GET variables in a URL, I always start screaming insecure in my head. It just seems risky to me. I think URLs like this just make more people want to try stuff. It also can affect SEO rankings. I'd do some mod_rewriting so that http://www.example.com/form/123/ automatically loads http://www.example.com/form.php?id=123. If nothing else, at least the URLs will look nice.

  2. Don't assume ID will always contain numbers. Rather than relying on your users passing numbers, and having MySQL escape them for safety, why not validate the ID yourself and make sure it only contains numbers?

  3. I don't know the exact implementation of prepared statements in PHP, so I won't bother giving you an example, but I'd recommend using them. They greatly reduce the risk of SQL injection.

Here's an .htaccess file to demonstrate URL rewriting:

<IfModule mod_rewrite.c>
  RewriteEngine on
  RewriteCond %{REQUEST_FILENAME} !-f
  RewriteRule ^form/([0-9]+)/?$ form.php?id=$1 [L,QSA]
</IfModule>

Validation:

<?php
if(preg_match("/^[0-9]+$/", $_GET['id']))
{
    // show record
}
?>
0

im going to try to work around your already bad programming practices ,
.1 never send raw ids to the users eyes
.2 always sanitize the data before query or your gonna find your self on the phone wih your hosting company all day reseting your severs....
.3 you can pass anything to your server and manipulate the data.

heres a way of going about it to prevent the user from changing this html markup:

//on the login page set a hidden id field like so .

<? 
$array = array('1,2,3,4,5,6,7,8,9,10');
shuffle($array);
$val = pop($array);
$val =  md5($val) 
?>

<form action="page.php?$val">
<input name="whatever" value "<? echo $val ?>"
..... rest of your form
</form>

then you want to make page.php with the following code

<?
switch($_POST['whatever']){
   case md5(1):
... run your login code
   break;
   case md5(2):
... run your login code
break;
   case md5(3):
... run your login code
break;
   case md5(4):
... run your login code
break;
   case md5(5):
... run your login code
break;
   case md5(6):
... run your login code
break;
   case md5(7):
... run your login code
break;
   case md5(8):
... run your login code
break;
   case md5(9):
... run your login code
break;
   case md5(10):
... run your login code 
break;
}
?>

now it doesn't matter what the number is because its random.... but if they so much is change one character in the URL it would not match the server defined md5 string,witch will not be caught by the switch statement..... now some additional error reporting is necessary but that's your job kid! Hope it helps.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.