Query string with dynamic content

Question

If I have this index:

if (isset($_GET['se'])) {
    $se= $_GET['se'];

    if (file_exists("{$se}.php")){
        require("{$se}.php");
    }
    else {
        require("page_error.php");
    }
}
else {
    require("page_error.php");
}

A link like the following doesn't work:

$pwrurl = "http://example.com/login/?se=change_password?usermail=".$email."&usercode=".$linkHash;

Only something like: http://example.com/login/?se=change_password will be accepted.

Can this be solved?

Try using a & as separator. You have two ? which is incorrect. — Has QUIT--Anony-Mousse
– Has QUIT--Anony-Mousse, Commented Jan 12, 2012 at 22:37

Edd · Accepted Answer · 2014-05-20 16:46:57Z

5

Beware!

Letting the user decide which file to include without any validation will introduce a vulnerability to your server. They could point your script to any sensitive file.

You should limit the possibilities of what can be included, like this:

$allowed_files = array(
    "page_error",
    "some_section",
    "some_other_section",
    "change_password"
    );

$se = empty($_GET['se']) ? "page_error" : $_GET['se'] ; // "page_error" by default.

if (in_array($se, $allowed_files)){
    require("{$se}.php");
} else {
    require("page_error.php");
}

This way they can only read the files you put in the array.

Edit: Also, just like everyone else said, you should separate different param=argument pairs in the URL with & instead of ?. The ? is used to separate the page name from the argument list.

http://example.com/login/?se=change_password&usermail=...

edited May 20, 2014 at 16:46

Edd

3,8423 gold badges29 silver badges34 bronze badges

answered Jan 12, 2012 at 22:46

Sebastián Grignoli

33.7k18 gold badges75 silver badges90 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

Sebastián Grignoli Over a year ago

Use that filter but don't rely on that only, because it will not protect you from the vulnerability I mentioned.

Has QUIT--Anony-Mousse · Accepted Answer · 2012-01-12 22:50:45Z

3

You have two ? in the URL. Multiple parameters have to be separated with &.

Your use of require is very dangerous. Read up on security. Validate any parameter before passing it to such a dangerous function, or your site will be hacked in no time.

edited Jan 12, 2012 at 22:50

answered Jan 12, 2012 at 22:38

Has QUIT--Anony-Mousse

77.8k14 gold badges146 silver badges198 bronze badges

Comments

Brandon - Free Palestine · Accepted Answer · 2014-05-18 21:30:16Z

2

The link is wrong, it should be '&' instead of '?' after change_password.

$pwrurl = "http://example.com/login/?se=change_password&usermail=".$email."&usercode=".$linkHash;

edited May 18, 2014 at 21:30

Brandon - Free Palestine

16.7k12 gold badges60 silver badges92 bronze badges

answered Jan 12, 2012 at 22:39

Dipu Raj

1,8944 gold badges33 silver badges39 bronze badges

Collectives™ on Stack Overflow

Query string with dynamic content

3 Answers 3

1 Comment

Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

3 Answers 3

1 Comment

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related