为$ _GET id实施强大安全标准的最佳方法是什么？

Question

I am seeking the strongest security measure for people changing the IDs in the URL for comments, blogs, inbox etc...

Any suggestions?

Answer 1

Validating the data you get is a great idea, if you're expecting digit, make sure you get digits.

if(isset($_GET['id']) && ctype_digit($_GET['id']))
{
  $id = $_GET['id'];
}else
{
  $id = 0;
}

If your concern is people changing urls to see things, like requesting image 44 when you only wanted to show them image 42 you've got a few options:

• Include various checks on the page to ensure the user has the appropriate permission to use the item.
• Hash the item in the url to make items immutable.
• Don't use sequential numbers, use random numbers or hashes.