php在输入无效网址后将用户移至404页面

Question

I'm designing a website but I know if the user enters a wrong character into my url, a not found page will open for him . and I know it can be a way to hack my website. What should I do for that? for example if the user enters a ' into my url like this:

http://example.com/article.php?id=585'

He move to a not found page which I have designed it or move to the first page or the last page he was in. Thanks.

Answer 1

You have to take 2 things into consideration:

1. Handling non-existent files
2. Handling non-existent article ids

Here's how to handle each case:

1) Create an .htaccess file and place it in your website root folder:

RewriteEngine on
ErrorDocument 404 /error.php # change this to your own 404 file path

2) Open the articles.php file and add this to the top (right after checking if your ID exists)

if(!valid_id($id)) {
    //if you have php 5.3- use this
    header('HTTP/1.1 404 Not Found');

    //if you have php 5.4+ use this
    //http_response_code(404);

    include('error.php'); //change this path to your own 404 file
    die();
}

Obviously, valid_id() is just a function example.