Is it possible to pass a variable to php without the users 'seeing it' ?

Question

I have a link on a page, and I would like to send a variable to a php file like this:

 href = "php_file.php?qry=$query"

the $query variable contains a query which I would like to make to mysql, inside the php file.

My problem is, I don't want the users to 'see' what I am passing along. I would like to use $_POST but from what I know, that isn't possible.

Is there any other simple way?

Thanks

Answer 1

That is not possible. Even if you used POST it would be very insecure.

My suggestion would be to put the query in the $_SESSION variable and reference it back in php_file.php If you have multiple queries you could give them some kind of IDs and store the id=>query pair in session.

Quick example:

<?php
session_start();
$_SESSION["query1"] = "SOME QUERY";
$_SESSION["query2"] = "SOME OTHER QUERY";

?>
<a href='php_file.php?q=query1'>Execute first query</a>
<a href='php_file.php?q=query2'>Execute second query</a>

//in php_file.php
session_start();
$query = $_SESSION[$_GET["q"]];

Obviously this is very simplistic and you might want to add some more "security" to it (check for empty parameters etc.) but at least your query wouldn't be visible to the user.

Answer 2

You could use sessions, or a cookie. But if you're trying to have the client send you information that the client cannot know about, I think you need to rethink the problem.

I hope $query isn't SQL!

Answer 3

Aside from encryption (and even then) if there's data on the client side, there's no way to prevent the client from being able to determine it's value.

Definitely do not put queries on the client side! Store whatever it is in the $_SESSION. That way the actual data is on the server side. It's never sent to the client, so they will never see it.

Answer 4

Yes, as stated use a session: http://www.php.net/manual/en/book.session.php

Also, don't stick URI params into a SQL query: http://php.net/manual/en/security.database.sql-injection.php

Answer 5

You obviously want to prevent users from loading stuff like php_file.php?qry=DELETE+FROM+users in their browsers by hiding or obfuscating the SQL code. I suggest you reconsider the whole idea: you're asking to be hacked.

You can hardcode a list of operations in your server side code and just pass an identifier, e.g.:

php_file.php?qry=fetch-totals

and then

<?php

if( $_GET['qry']=='fetch-totals' ){
    // ....
}

?>

Answer 6

Well if you don't want them to actually see the query parameters in a link try any URL shortening service (google will help). And when the user is redirected to you save this parameter to session and then do the redirect once again but without any query parameters. This solution will only work in case, once again, the link is just ugly and you don't want to leave it like that. As mynameiscoffey said savvy will still be able to figure it out.

As well as cookies, hidden forms, JavaScript and so on BTW.

Answer 7

You can, in theory, use encryption, and decrypt the value on the server. The overhead is huge, however. And a sophisticated enough user will get to it anyway. The plaintext of the value to be hidden will exist in a variable at some point; a debugger and a breakpoint at just the right time is all they need.

In this scheme, it does not matter how complex the encryption is. You don't have to go all the way with RSA or somesuch; something like XOR with key will suffice. You're protecting against casual snooping here, not against a determined attack.