How to obscure a GET variable?

Answer 1

Couple solutions stand out:

• Store the names & classes in a database, and reference them with a numeric ID instead of passing the data in the request
• Keep the information in the request, but add a secure hash that will prevent tampering with the data

The hash mechanism would be something like this:

When generating the link for the certificate, you have $name and $class. You'll create a third GET variable that is a hash of $name, $class, and a secret string that only your program knows. Something like this:

$salt = "this is my secret";
$hash = md5($name . $class . $salt);
$url = "http://www.mysite.com/certificate.php?name=" . urlencode($name) . "&class=" . urlencode($class) . "&hash=" . $hash;

Now when a user hits your certificate generation page, you must verify the hash:

$salt = "this is my secret";
$expected = md5($_GET['name'] . $_GET['class'] . $salt);
if ($expected != $_GET['hash']) {
  die("You are not authorized");
} else {
  // User is OK; generate the certificate
}

Answer 2

Yes, if you want to limit your inputs to a fixed pool, then creating a database full of random keys is the way I would go.

If you want a quicker and dirtier way to do it, just generate the keys into a text file, use a script to pull the file apart to send them to the recipients, and have your PHP certificate generator read from a copy of the file on the server.

Answer 3

Should I just create a set of random numbers and associate these with the student/workshop pairs in a database?

Yes.

Answer 4

Your best bet would be to have a list of students/classes (some kind of database) and only allow generation of allowed certificates. That way you don't need to obfuscate the name of the student or class, because only valid certificates can be generated.

If that's too much to ask - you could generate a MD5 hash based on the combination and some salt, then add that hash to the URL. That way the salt would need to be know to forge a URL.

http://www.example.com/makepdf.php?name=Tim&class=PHP&hash=c2c455ce438112b44499561131321126

Then the generation script just does this:

$hash = md5($_GET['name'] . $_GET['class'] . $salt);
if($hash != $_GET['hash']){
  //invalid request
}

Of course you'll need to generate the URL's with the same salt.

Answer 5

Assuming you are generating these URLs yourself on the server, you could join all your parameter values together into a string:

hash_string = "myname:classname";

Then append a final parameter that's a hash of that string along with some secret seed:

query_string .= "&h=" . md5("my_secret_key:" . hash_string)

Then, when you get the query back, just check to make sure that the hash matches:

hash_string = params['name'] . ':' . params['class'];
if (params['h'] == md5("my_secret_key:" . hash_string)) ...

I don't really know PHP syntax, but you get the idea.