php file in URL - security

Question

Is it still secure to have urls like:

http://www.website.eu/product.php?id_product=916

If not, what are security cons? Can someone please point me a link on updated information about this practice regarding security.

Thank you

It's as secure as the underlying script and its supporting software/hardware is. If you keep the server's software up to date and take every measure in the code to avoid malicious use then it's perfectly secure. If you're hinting that you want to hide the .php extension, it's entirely possible to do so but in no way will it improve your server's security. Security through obscurity just doesn't work. — GordonM
– GordonM, Commented Jan 16, 2014 at 14:07

MueR · Accepted Answer · 2014-01-16 14:09:04Z

1

There's no security cons as far as I know. As long as your code sanitises all user input and you don't leak sensitive info like file paths or queries when an error occurs, you should be fine. Just be sure to block all access to directories where users should not be, such as your libraries or configuration directories.

answered Jan 16, 2014 at 14:09

MueR

9777 silver badges13 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

Akshat Goel · Accepted Answer · 2014-01-16 14:12:36Z

1

The most basic thing that you can do here is convert this to lofical URL instead of a physical URL which it is right now.

physical URL - http://www.website.eu/product.php?id_product=916
Logical URL  - http://www.website.eu/product/916

This would expose only the needed things and not the complete implementation style of the code.

To do this you will have to make some minor changes to the .htaccess file of the folder where product.php is present.

RewriteEngine on
RewriteCond %{REQUEST_FILENAME} !-d
RewriteCond %{REQUEST_FILENAME}\.php -f
RewriteRule ^product/$ product.php?product_id=$1 [NC]

answered Jan 16, 2014 at 14:12

Akshat Goel

7863 gold badges6 silver badges21 bronze badges

4 Comments

GuyT Over a year ago

This doesn't make sense. If you want to do a SQL injection you don't need to know that the $_GET parameter is 'id_product' because it's automatically set in the script. With or without URL rewriting you've the same script. $product_id = $_GET['product_id']; in both cases.

Akshat Goel Over a year ago

But it is still better to not expose the exact physical URL of the file.

Adib Aroui Over a year ago

Thank you @AkshatGoel for the suggestion, it is a good enhancement (to do not expose the exact physical URL). However GuyT remark is right.

Akshat Goel Over a year ago

@whitelettersandblankspaces - You're welcome. I agree that this wont prevent a SQL injection.

Collectives™ on Stack Overflow

php file in URL - security

2 Answers 2

Comments

4 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

Comments

4 Comments

Your Answer

Sign up or log in

Post as a guest

Related