Question

This url contains a parameter with text :

my-page.php ?id_article=1&alias=article-name

The result after rewritting is :

1-article-name.php

For id_article parameter, i made this security :

if (isset($_GET[id_article] && $_GET[article] != null && $_GET[id_article] >= 1 && $_GET[id_article] <= 4 && (int) $_GET[id_article])

What can i do for alias parameter which accept text ?

Answer 1

Firstly, does alias get from database?

For your exmple :

my-page.php ?id_article=1&alias=article-name

The result after rewritting is :

1-article-name.php

My question is : what do you gonna display in 1-article-name.php, is the content is get from the mysql database?

if so, just use mysql_real_escape_string to sanitize the alias.

Of course, first the alias must not be empty:

if(!empty($_GET['alias'])){}

and then use mysql_real_escape_string

Don’t think that: $_GET, $_POST, $_COOKIE, etc are safe.

Please kindly use mysql_real_escape_string function to sanitize your variables if you embed a string in some SQL targeting MySql, you must escape the string with MySql’s function for this purpose :

Use htmlspecialchars If you embed strings within HTML markup, you must escape it with htmlspecialchars. This means that every single echo or print statement should use htmlspecialchars.

Good luck.