Encrypting or Hiding Strings sent in the url

Question

Hello

I am trying to send a Topic name in the URL like,

<a href="hello?TopicN=blahblahblha">

and then output the topic name as the Forum topic title. But the problem is the user can just change the name if they want which doesnt do any harm since I dont really do anything with teh name but I was wondering is there a way to encrypt or swap the letters so its not so obvious what the topicN is ?

I also tried md5 encryption but, md5 is only 1 way so that doesnt help. Could use sessions, not sure since i store user login details in sessions,

any ideas and examples would be helpful,

Thank you

Answer 1

MD5 is hashing, not encryption, so that won't help.

Consider passing an identifier to a row in your database so that you could lookup the title.

<a href="hello.php?TopicN=1234">

Trusting the client is a big no-no for many reasons, and this is one of them.

Using the session to store this information would work, but it seems inappropriate given that (I suspect) TopicN could (or, does) change frequently.

Good luck!

Ian

Answer 2

You could use base64_encode and base64_decode, it makes it less obvious.

base64_encode(blahblahblha) = YmxhaGJsYWhibGhh

base64_decode(YmxhaGJsYWhibGhh) = blahblahblha

I'd question the purpose or benefit of this requirement though.

Answer 3

I would advise you to do the reverse even.

Make it more search engine and user friendly, like so: forum/thread/blabla

If you are using Apache search for Rewrite Engine

Answer 4

Try this:

File: .htaccess

RewriteEngine On
RewriteRule url/(.*) url_parser.php?url=$1 [L,QSA]

File with the links:

<a href="<?php echo base64_encode("hello?TopicN=blahblahblha"); ?>">Link</a>

File: url_parser.php

<?php
$encodedURL = filter_input(INPUT_GET, 'url', FILTER_SANITIZE_STRING, FILTER_FLAG_STRIP_LOW | FILTER_FLAG_STRIP_HIGH);

$unencodedURL = base64_decode($encodedURL);
$urlParts = parse_url($unencodedURL);

$newURL = $urlParts['path'];

// See if there are any extra _GET parameters on this URL:

// Add encoded _GET params:
$newURL .= '?' . $urlParts['query'];

// Add extra _GET parameters:
$newURL .= '&' . $_SERVER['QUERY_STRING'];

// Add any passed #
$newURL .= '#' . $urlParts['fragment'];

// Redirect to the new URL:
header('Location: ' . $newURL);

// If you want to hide the URL completely, do this:
readfile($newURL);