Question

I am passing a database generated id value in a link to another page. In the receiving page where I call $_GET, I want to protect against people inserting bogus values after the ? in the url (e.g. http://www.mysite.com?id=43).

I want to check the incoming value and make sure it’s a valid id from the database, or is there a way to just check the value for NULL or empty? This is what I’ve tried:

Source page:

 echo "<a href=\"get-post-pg2.php?id=" .urlencode($row['id']) ."\">Second Page</a>";

Target page:

$id = $_GET['id'];
if(isset($_GET)) {
    echo $id;
} else
    echo 'foo';
}

Answer 1

What you should do is cast the $_GET variable to an integer…

$id = (int) $_GET['id'];

Then check if empty..

if(!empty($id)){
     // process code
}

Any string will be converted to zero which returns as empty in php.
Then check to see if that id exists in your database!