Question

I am currently displaying errors on my website using this code:

<?php
$failure = strip_tags($_GET['failure']);
if($failure!=""){
echo '<div class="error">';
echo $failure;
echo '</div>';
}
?>

However, I am curious if this is safe. Is it?

Answer 1

while this solution would change a little bit your approach, why not have an errors.php file with this structure?

$error[1] = 'some error message';
$error[2] = 'some other error message';
$error[3] = '...'; // you get the point

And the just send an ID as the error:

somepage.php?failure=2

Then, include this code where you usually display your errors:

if($_GET['failure'] && array_key_exists($_GET['failure'],$error) {
    echo $error[$_GET['failure']];
}

Just be sure to include errors.php in your config.php file (or whatever your main configuration’s file name is).

Why?

1. Errors are often repeated, this way you can use them over and over again.
2. If you want to translate the site to another language, this system will be very helpful.
3. If you need to change a word on an error message, you will just have to change it once in the errors.php file.

IMHO it is much much safer to use ints than strings in this case.