Comments on: Tips for Protecting Querystring Keys & Values in PHP http://davidwalsh.name/tips-protecting-querystring-keys-values-php Legendary scribbles about JavaScript, HTML5, AJAX, PHP, CSS, and ∞. Thu, 09 Feb 2012 15:40:33 +0000 hourly 1 http://wordpress.org/?v=3.3 By: Jamiehttp://davidwalsh.name/tips-protecting-querystring-keys-values-php/comment-page-1#comment-28118 Jamie Tue, 27 Dec 2011 09:10:31 +0000 http://davidwalsh.name/?p=271#comment-28118 There is very little reason I can see for using query strings, ever! Ok one, debugging. I work for a company who sells theatre tickets. We use a very good database system that is used by many of the household known branded ticket agents. So when any large scale concert goes on sale, I can always get tickets quickly and easily (sometimes before they go on sale!)... Why because the practise of using querystrings. However, I have always recommended (although people don't always listen!) that using form POSTs are far better. Yes people in the know will second guess that you are supplying information to the next page but the average joe isn't going to check the source code. And the average Joe isn't going to then copy the source code onto a page and submit it. It takes the temptation out of the URL bar. If you are supplying info to your own page, use a POST and if you ise it often store it in a Session variable. That way it is only seen once at point of entry, the most hidden way needed. There is also very little reason (with a little slightly optional validation) why you couldn't ask external sites to use forms either. If you offer commision it is also then easier to collect a referral URL or id.I imagine this may be a little controversial judging from past reactions and I am open to changing my mind if theres a compelling argument. There is very little reason I can see for using query strings, ever! Ok one, debugging.
I work for a company who sells theatre tickets. We use a very good database system that is used by many of the household known branded ticket agents. So when any large scale concert goes on sale, I can always get tickets quickly and easily (sometimes before they go on sale!)… Why because the practise of using querystrings.
However, I have always recommended (although people don’t always listen!) that using form POSTs are far better. Yes people in the know will second guess that you are supplying information to the next page but the average joe isn’t going to check the source code. And the average Joe isn’t going to then copy the source code onto a page and submit it. It takes the temptation out of the URL bar.
If you are supplying info to your own page, use a POST and if you ise it often store it in a Session variable. That way it is only seen once at point of entry, the most hidden way needed.
There is also very little reason (with a little slightly optional validation) why you couldn’t ask external sites to use forms either. If you offer commision it is also then easier to collect a referral URL or id.

I imagine this may be a little controversial judging from past reactions and I am open to changing my mind if theres a compelling argument.

]]> By: Johnhttp://davidwalsh.name/tips-protecting-querystring-keys-values-php/comment-page-1#comment-22346 John Tue, 18 Jan 2011 09:15:11 +0000 http://davidwalsh.name/?p=271#comment-22346 I have always wanted to know how do I remove/clear the querystring portion from the URL after I extacted the data in the same function? I have always wanted to know how do I remove/clear the querystring portion from the URL after I extacted the data in the same function?

]]> By: rabiahttp://davidwalsh.name/tips-protecting-querystring-keys-values-php/comment-page-1#comment-16725 rabia Thu, 01 Apr 2010 06:41:17 +0000 http://davidwalsh.name/?p=271#comment-16725 hi... im using php4 and dw_encrypt is not eorking here is the code in which i embedded dw_encrypt <a href="search.php?msg= ">hi</a> hi…
im using php4 and dw_encrypt is not eorking
here is the code in which i embedded dw_encrypt
<a href="search.php?msg= “>hi

]]> By: Rabe'e Wahabhttp://davidwalsh.name/tips-protecting-querystring-keys-values-php/comment-page-1#comment-2610 Rabe'e Wahab Wed, 06 Aug 2008 12:49:20 +0000 http://davidwalsh.name/?p=271#comment-2610 thanx alot .... this post is simple and very userful thanx alot …. this post is simple and very userful

]]> By: Martien de Jonghttp://davidwalsh.name/tips-protecting-querystring-keys-values-php/comment-page-1#comment-2545 Martien de Jong Sat, 02 Aug 2008 12:37:38 +0000 http://davidwalsh.name/?p=271#comment-2545 I agree with Jay about the varnames and encryption thing. Authorization should be done in the back-end code, not in the querystring ;) When we make sure someone cannot access content they are not allowed to, we can user any variable we want in the querystring, since we know nothing is gonna happen. As a suggestion, can you add a section about strings vs integers (ie. userID vs account name) and how to handle it. That would be really nice. Regards, Martien de Jong I agree with Jay about the varnames and encryption thing.
Authorization should be done in the back-end code, not in the querystring ;)
When we make sure someone cannot access content they are not allowed to, we can user any variable we want in the querystring, since we know nothing is gonna happen.
As a suggestion, can you add a section about strings vs integers (ie. userID vs account name) and how to handle it.
That would be really nice.
Regards,
Martien de Jong

]]> By: Jayhttp://davidwalsh.name/tips-protecting-querystring-keys-values-php/comment-page-1#comment-1409 Jay Fri, 30 May 2008 13:13:54 +0000 http://davidwalsh.name/?p=271#comment-1409 Essential PHP Security is the way to go, this is what we use as our handbook. It's really short and pretty thorough:http://www.amazon.com/Essential-PHP-Security-Chris-Shiflett/dp/059600656X/ref=pd_bbs_sr_1?ie=UTF8&s=books&qid=1212153167&sr=8-1 Essential PHP Security is the way to go, this is what we use as our handbook. It’s really short and pretty thorough:

http://www.amazon.com/Essential-PHP-Security-Chris-Shiflett/dp/059600656X/ref=pd_bbs_sr_1?ie=UTF8&s=books&qid=1212153167&sr=8-1

]]> By: Jayhttp://davidwalsh.name/tips-protecting-querystring-keys-values-php/comment-page-1#comment-1401 Jay Thu, 29 May 2008 21:42:54 +0000 http://davidwalsh.name/?p=271#comment-1401 By one way I mean you can't decrypt hashes so that's not a good way of passing data if you need it decrypted. By one way I mean you can’t decrypt hashes so that’s not a good way of passing data if you need it decrypted.

]]> By: Jayhttp://davidwalsh.name/tips-protecting-querystring-keys-values-php/comment-page-1#comment-1400 Jay Thu, 29 May 2008 21:42:07 +0000 http://davidwalsh.name/?p=271#comment-1400 Ya don't do the changing of var names, that really doesn't get you any more security. Also passing hashed deals as parameters doesn't really make sense to me, I'd rather use an encrypted session to handle those. And hash of course is one way.The main way to secure php pages is just like securing any other language, escaping input and output. Most programmers escape input but alot still don't escape output which is why XSS hacks are so rampant. I am guilty of this as well sometimes, usually trusting data from a database even tho it originated for a user. Technically you should really escape all data regardless. Ya don’t do the changing of var names, that really doesn’t get you any more security. Also passing hashed deals as parameters doesn’t really make sense to me, I’d rather use an encrypted session to handle those. And hash of course is one way.

The main way to secure php pages is just like securing any other language, escaping input and output. Most programmers escape input but alot still don’t escape output which is why XSS hacks are so rampant. I am guilty of this as well sometimes, usually trusting data from a database even tho it originated for a user. Technically you should really escape all data regardless.

]]> By: davidhttp://davidwalsh.name/tips-protecting-querystring-keys-values-php/comment-page-1#comment-1359 david Wed, 28 May 2008 13:01:30 +0000 http://davidwalsh.name/?p=271#comment-1359 @Steffan: Oh wow -- I have no clue how I missed that. I do have an encrypt/decrypt function but the md5 doesn't do that. Sorry -- totally whiffed on that one. @Steffan: Oh wow — I have no clue how I missed that. I do have an encrypt/decrypt function but the md5 doesn’t do that. Sorry — totally whiffed on that one.

]]> By: Steffanhttp://davidwalsh.name/tips-protecting-querystring-keys-values-php/comment-page-1#comment-1357 Steffan Wed, 28 May 2008 10:26:58 +0000 http://davidwalsh.name/?p=271#comment-1357 My thought on "Encrypt Querystring Values"<a href="/profile.php?i=">Click here</a>The so called encryption used in this example is actually a hash. The significance of a hash function is you cant reverse the hashed value back to its original value. In opposite to encryption/decryption, there is no de-hash. So if you want to decrypt Http get values use encryption like RSA, 3DES etc.Different approach: you can add a md5 hash to verify your Http Get parameters and check if non of them has been modified. Further you would need a secret value which you include within your hash.<a href="/profile.php?user_id=&check=">Click here</a> My thought on “Encrypt Querystring Values”

<a href=”/profile.php?i=”>Click here

The so called encryption used in this example is actually a hash. The significance of a hash function is you cant reverse the hashed value back to its original value. In opposite to encryption/decryption, there is no de-hash. So if you want to decrypt Http get values use encryption like RSA, 3DES etc.

Different approach: you can add a md5 hash to verify your Http Get parameters and check if non of them has been modified. Further you would need a secret value which you include within your hash.

<a href=”/profile.php?user_id=&check=”>Click here

]]>