Have Geek Brain

Request and URL security

In the url request with id I am using is_numeric($_GET['id'])

for security issues. But in a query like the category name, is there a urlencode()

correct path for security? Thanks in advance.

+2


a source to share


1 answer


No, it is urlencode

used to convert strings to URL encoding.

Unlike a numeric identifier, there is no uniform method to sanitize the input string value. Which method you need to use depends on what you want to do with the category name.

For instance:



  • If you want to use it in a query, run at least a mysql_real_escape_string()

    on it, or (better) use a database class that supports parameterized queries (like PDO). With parameterized requests, PDO takes care of the safe disinfection of any incoming parameters.

  • If you want to output it to the page, you need to run htmlentities()

    on it before outputting to prevent HTML injection.

there are other things to consider when using a category name as a filename when using it as part of a url, etc. etc.

+2


a source






More articles:


All Articles