Question

I have a simple php script where hopefully people can simply go to something like http://mydomain.com/get.php?id=TEXTMASH-1FD0066D-F75A-5D0C-6784-2FA0D055B0D7 and pull up this text block from my mysql db. I’m very new to php. Knowing that all of expected IDs should be something in the format of TEXTMASH-1FD0066D-F75A-5D0C-6784-2FA0D055B0D7 how can I “sanitize” the _GET so it’s not vulnerable to any attacks? I’ve looked at some guides but, i’m just not getting it. Anyone mind showing me? I’d really appreciate it.

<?php 

include_once("../../extern/dbinclude.php");

$id= $_GET['id'];

$result = mysql_query("SELECT text FROM mytable WHERE id='$id'")
or die(mysql_error());  

$row = mysql_fetch_array($result);

if($row)
{
echo nl2br($row['text']);
} else {
?>
<h2>Invalid URL</h2>
<?php
}

Answer 1

You could either use mysql_real_escape_string or possibly a regex to check the input. One possible regex for your case:

$pattern = '/^TEXTMASH-[0-9A-F]{8}-[0-9A-F]{4}-[0-9A-F]{4}-[0-9A-F]{4}-[0-9A-F]{12}$/';
if(!preg_match($pattern, $id))
{
    echo "No dice >:(";
    exit;
}