Best practices to deal with absent/wrongly typed GET variables?

Question

What do you do when you detect your get request is broken or is passing wrong types of data? Say you have a forum-page.php?forum=3 that lists all the topics related to forum 3.

What would be a good way to deal with the absence of the "forum" variable? What about if instead of being an integer, you would get a string? How would you respond to such a wrong request?

• Spit out an error telling why you refused the request
• If forum-page.php is called without the "forum" variable simply redirect to a default page, something like forum-page.php?forum=1. The same thing for a wrongly typed forum variable.
• Redirect to some other page. Something like the forum/board index?
• Other options?

Would really love to read your opinions about this.

Answer 1

I typically return a 400 (Bad Request) with a status description explaining why (eg. "forum parameter is required"). Not sure if PHP allows this (ASP.NET does), but then you could then map a 400 to a custom page that displays the error in a way that makes sense for your application.

HTH, Kent

Answer 2

It depends quite a bit on each page and their GET requests. Most pages like the one you used as an example can fail gracefully, but others which have required variables missing may need to throw a 400 (Bad Request) or a 404 (Page Not Found). 404 is actually quite necessary because there may be a bad link being spidered by a search engine or being passed around through the internets, so you'd want to stop this behavior.

My view is to try the following:

1. For wrong/missing required variables, throw a 400 or a 404 (depending on your app). However, for a 400, I would fail gracefully to the default page (forum-page.php) and show the error in a error box at the top of the page.
2. For wrong non-essential variables that may be mistyped, fail gracefully to the default page.
3. For wrong non-essential variables that are completely the wrong format or object type, throw 404's since they may be attempts at subverting the security of your app.

Ultimately, the really important thing to never do is to try to "guess" the wrong/missing variables and fill it for the user (in most cases). I've come across many webapps where this behavior was misused by hackers to trick the webapp to simulate a vulnerability.