Security and passing values in URL

[Dude0]

Hello,

this application have a scheme where the user chooses a category in a first page, and then a list of subcategories appears. Then the user choses one of those.

The values are passed using the URL ($_GET).

Example

First selection

whatever.php?main_id=10

Second selection

whatever.php?main_id=10&sec=89

This could lead to problems for example if the user changes the initial selection after chosing the subcategory. At that point if the arguments get used, there can be problems because the category and subcategory codes are not realted.

Solutions:

• Saving the initial selection in a cookie
• Getting the parent category code from the database with the secondary code
• Others?

What's the best way to do this?

Thanks for your help.

[atmorell]

Save main_id and sec in SESSIONS, and only display/set the GET vars that need to be changed. When main_id is in a SESSION you don't need to set it in your link anymore.

Best regards.
Asbjørn Morell.