PHP: managing url $_GET tinkering

Question

hi,

Here's a situation, i have a list of support tickets that when you click the title of the ticket takes you to a page that displays the ticket in more detail. If uses URL GET variables to query the database. I've taken SQL injection into account but what if someone modifies the url to an id that doesn't exist? whats the best way to deal with that?

Thanks,

Jonesy

Answer 1

If the ID does not exist, send a 404 - Not Found header along with a nice error page telling the user that it wasn't found.

Answer 2

Check if the ticket exists; if not, react accordingly. What "react accordingly" means is determined by your business logic: create a new ticket? raise an error? take the user to a list of available tickets?

An example using the old mysql extension for brevity:

$sanitized_numeric_id = (int) $_GET['ticket_id']; // assuming id is numeric
$query_resource = mysql_query('SELECT `somecolumn`, `column2`, `othercolumn` 
                                  FROM `tickets`
                                  WHERE `id`= ' . $sanitized_numeric_id);
if (mysql_num_rows($query_resource) > 0) {
    // the ticket exists, do something with it
} else {
    // the ticket doesn't exist, react accordingly
}

Answer 3

You probably have to make a page handling unsuccessful searches anyway; just route it in there. Then you can help the user to find what (s)he searches in a consistent way, provide cues and "most-searched-after" and what not.

Answer 4

This may seem too simple, but you should always validate your GET (or POST) variable before doing anything with them. In your case, just verify that the ID exists in the database. If it doesn't, inform the user.

Answer 5

You should always check if your querry returned anything. If it return 0 rows the ID doesn't exist.

<?php

$result = mysql_db_query("your query", $link);
$num_rows = mysql_num_rows($result);

if($num_rows < 1){
  // row with that id doesnt exist
  // do whatever you want
}elseif($num_rows > 1){
  // you have problem with your ids in db
}else{
  //everything went fine
  // do your ting here
}

?>