php url parameters check

Question

I'm creating a website that relies on $_GET to function correctly. It works like this: http://www.example.com/show?q=14&i=48 q and i are IDs on MySQL server that must be fetched using mysql_query() and the like. Parameters are always integers.

If someones type the url without any parameters both PHP and MySQL yells errors. PHP for undefined variable(s) and MySQL for incorrect syntax.

What i've tried so far doesn't works i always get "Error";

if (is_int($_GET['q']) AND is_int($_GET['i']))
{
 echo "All good.";
}
else
{
 echo "Error.";
}

What am i doing wrong here.

Thanks, atno

Matteo Riva · Accepted Answer · 2010-09-23 14:49:27Z

2

That's because you're checking the type of the variable and not its content. Anything coming from a query string via $_GET is considered a string, so you should use ctype_digit() instead if is_int(), and also checking if the values are present with empty().

answered Sep 23, 2010 at 14:49

Matteo Riva

25.1k13 gold badges75 silver badges105 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

Jim Over a year ago

+1, my thoughts exactly. ctype_digit() or even doing $_GET['i'] = (int)$_GET['i'];

Matteo Riva Over a year ago

Casting also works, but I'd rather reject bad input than fix it

Fortega · Accepted Answer · 2010-09-23 14:53:59Z

2

You should use is_numeric instead of is_int.
is_int returns false for numeric strings.

Downside is that the is_numeric function also returns true for numbers like "1.5". If you don't want that, you can check the function here

edited Sep 23, 2010 at 14:53

answered Sep 23, 2010 at 14:47

Fortega

19.7k15 gold badges78 silver badges115 bronze badges

Comments

Jose Vega · Accepted Answer · 2010-09-23 14:48:09Z

0

You should try the isset($_GET[q])

if(isset($_GET[q]) && isset($_GET[i])){

}

answered Sep 23, 2010 at 14:48

Jose Vega

10.3k7 gold badges43 silver badges58 bronze badges

2 Comments

afarazit Over a year ago

isset() isn't the right function to solve it because as kemp said everything in $_GET considered a string. So example.com/show?q=&i= returns "All good."

Jose Vega Over a year ago

According to the question, the case on your example does not happen. He says, "If someones type the url without any parameters both PHP and MySQL yells errors." In your example there exist two parameters. My partial solution only helps on the PHP side, but not on the MySQL side.

Collectives™ on Stack Overflow

php url parameters check

3 Answers 3

2 Comments

Comments

2 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

3 Answers 3

2 Comments

Comments

2 Comments

Your Answer

Sign up or log in

Post as a guest

Related