Stop changing POST vars via URL

[kbc1]

Hi

I have seen sites that re-direct users to an error page when users try to change the variables passed via the URL to another page of the site (example a search results page).

Lets say I am passing

'&id=1&productid=2&personid=3'

How would you implement this error page if i changed the vlaue of one of those variables by hand?

Thanks in advance for any comments.

[esukf]

One way to do this is to append a hash of the values to the url and on the other page check whether the hash has changed. i.e.

page with the link

<?php
//salt for hash
$salt = "your_secret_word";
//the real values
$url = '&id=1&productid=2&personid=3';
//create hash
$check = md5($salt . $url);
//append hash to querystring
echo '<a href="linkcheck.php?'.$url.'&check='.$check.'">link</a>';
?>

linked page

<?php
$salt = "your_secret_word";

$check = $_GET['check'];

$url = '&id='.$_GET['id'].'&productid='.$_GET['productid'].'&personid='.$_GET['personid'];

if($check != md5($salt . $url)){
	echo "url changed";
}
?>