Question

How safe is it to use an unfiltered $_GET variable directly within a switch function as shown in the example below?

<?php

 switch ($_GET['sort'])
 {
  case "price":
  // Do something
  break;

  default:
  // Do something else
  break;
 }

?>

Is it possible to compromise the security of my application if the $_GET variable only appears within this switch function throughout the entire PHP script?

ADD: For that matter, will an unfiltered $_GET variable cause a comparison operation to fail in a catastrophic manner?

Answer 1

It’s fine to test values from $_GET in a switch. That’s validation in and of itself. The danger is when you let that value work its way into a filesystem path, or database query, or HTML block, or (shudder) eval’d code without context-appropriate sanitization.