How do I make it secure?

simes77

OK, I'm very new to PHP (and programming) so I copied this example: http://www.indiwiz.com/web/ServerSide/59 It works fine.

Instead of colours I used it to put a different city name in a block of text eg New York is abig city or London is a big city. Depending on which link you clicked.

The problem I have is that I can replace ?city=London with ?city=whatever you like (in the URL in the browser window) What would I have to do to stop visitors from doing this?

Sorry if this is a really dumb question, but hey, got to learn somehow.

laserlight

You cant stop that sort of thing, but you can validate the incoming data.

simes77

Ok, I'm totally stuck. I've looked at various websites and at various books (I'm totally confused, session variables, switch statements have been mentioned to me, now I'm totallly lost)

At this point I've now got:

<?
if($_GET['city']=="NewYork")
echo("New York");
elseif($_GET['cf']=="London")
echo("London");
?>

This works but what do I need to put in to have a default? laserlight is this what you mean't by validating the data?

simes77

Sorry code should be:

<? 
if($_GET['city']=="NewYork") 
echo("New York"); 
elseif($_GET['city']=="London") 
echo("London"); 
?>

simes77

I've worked it out! (I had a sudden flash of brilliance) 😃

laserlight

If there are more than 3 possible values for $GET['city'], you might want to consider using a switch structure:

if (isset($_GET['city'])) {
	switch ($_GET['city']) {
	case "NewYork":
		echo "New York";
		break;
	case "London":
		echo "London";
		break;
	default:
		//invalid city given
	}
} else {
	//no city given
}

or perhaps an array with the keys as the valid values of $_GET['city'], and values as the data to be used:

$cities = array("NewYork" => "New York", "London" => "London");
if (isset($_GET['city'])) {
	if (array_key_exists($_GET['city'], $cities)) {
		echo $cities[$_GET['city']];
	} else {
		//invalid city given
	}
} else {
	//no city given
}

simes77

There might be 20+ cities so is this ok, If I put this in the head of the page:

<?
if ($_GET['city'] ==" ")
$cities="default";
elseif ($_GET['city'] !=" ")
$cities = [$_GET['city']];

and in the body (where I needed the name to appear):

<? echo $cities?>

Would I have to limit the lenght of city so that mallicious code / text couldn't be entered

laserlight

Would I have to limit the lenght of city so that mallicious code / text couldn't be entered

I think that you misunderstood the idea here.
Yes, checking for an overflow can be useful, but here the idea is to check the incoming variable against an array of allowed values.

In my array example, $cities is this array that contains all the values allowed.
We take advantage of the associative array as a map to map the values allowed from the incoming variable, to the value that you will actually use.