check url variable is valid in php

Question

hi I have a site where the links menu is read from a database and created in the format of index.php?page=mypage

how can I check that "mypage" is a page that exists in the database, so that users can't just add anything into the url?

thanks xx

Database? What database? If the data is read from the database, how can it NOT be in the database - unless your database is a very long way from being normalized. — symcbean
– symcbean, Commented Jan 18, 2011 at 12:31
I was concerned about the user putting their own value in the url that didn't exist. — paula
– paula, Commented Jan 22, 2011 at 20:08

Tobias · Accepted Answer · 2011-01-18 12:07:43Z

1

If your pages are stored within the database: check the result set of the SQL-Query you´re sending to the database and don´t forget to escape characters to deny possible SQL-injection... ( mysql_real_escape_string() )

answered Jan 18, 2011 at 12:07

Tobias

7,40311 gold badges51 silver badges82 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

Alix Axel · Accepted Answer · 2011-01-18 12:33:21Z

1

Use a whitelist approach, something like this:

$allowedKeys = array('myPage', 'yourPage', '...Page');

$_GET = array_intersect_key($_GET, array_flip($allowedKeys));

answered Jan 18, 2011 at 12:33

Alix Axel

155k99 gold badges406 silver badges508 bronze badges

Collectives™ on Stack Overflow

check url variable is valid in php

2 Answers 2

Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related