PHP Security when Passing MySQL Unique ID via Get

Question

Lets say I have a website with links to various books on my main page.

<a href='books.php?id=1'>Book 1</a>
<a href='books.php?id=2'>Book 2</a>
<a href='books.php?id=4'>Book 3</a>

Books 1-3 are in my system, however id=3 is apart of another catelog that I'm not showing or authorizing through this section of the site. So if a user clicked on Book 3, then changed the id=4 to id=3, they could simply pull up the record (assuming I don't have proper session checking).

Is there a good way to obscure the get id that you're passing when trying to pull a specific record? it seems by passing just the id would be easy to request pages that, without proper querying and session checking, you would be able to get another result.

Is there a better way to do this?

Cheers

Answer 1

Just check id if it is allowable to display or not.
With get's a good practice is when you check whatever parameters you may have.

Answer 2

You need to always, always, check that user is able to access the page. That is the only way to verify that you don't show wrong data, because someone can always modify the link they are going to, even if you somehow hide it.

There is just no escaping it. You always need to verify that the record can be accessed.

Answer 3

You probably could hash your id or something using md5 or whatever to make it harder to manually enter, but that's really not a good idea.

What you should do is to implement server side security in your books.php script that will prevent users from unauthorized access. That's the only thing that will keep your site secure.

Answer 4

just thinking out loud:

1. you can make a column in your book mysql table saying "visible" ... or userlevel in your users tables.

2. do a php function or if statement that:

   if (user is not in user_level) // user is not allowed to see everything
   {
       redirect to previous page;
   }
   else if (user is in user_level) // user is allowed to see everything
   {        
       display all items;
   }
   

Answer 5

You definitely need to check whether the user is allowed to view the page.
But, what if you separated the ids for the different catalogs? URL's could look like books.php?cat=foo&id=1. That wouldn't necessarily make things any more secure, but it would prevent people from accidentally finding the wrong pages and organize things a little better.