security : limit url inputs to words

auday1982

Hello

i am learning and now confused , which function to use beside the regular expressions and how to use it the best way and most secure

for example dom.dom/file.php?display=

"display" should be on of these options ONLY

1- top , display top articles ( most viewed all time )
2- hot , display the most viewed articles of last week
3- all , display all articles sorted by date ( newer first )

and other stuff

all my inputs should be nothing than these words ( top , hot and all) , in other places like for displaying articles , i need to make sure ID= NUMBERs ONLY

so what is the best function to use for php 4 and 5 , to make sure nothing else is inputed

i tried to write a script to do this with help from sources on the web and php manual

i ended having the preg match working wrong way , because it is not the function i need , i got the result like this

file.php?display=top echo "correct" for no error , echo $GET display will give me(top)
file.php?display=topANYTHING echo "not correct" , echo $GET display (topANYTHING)

i am unable to do these small stuff because regular expression is the most dificult thing i found in php

no way i can make sure nothing before or after TOP , ALL , or HOT ? whatever <scripts things , or that " OR 1=1 " so i make sure no way my application accept something else than what i specified

please give me ideas or codes but please explain so i know what is going on , i found scripts on php classes but most of them not easy to know what is it doing so i still dont know what the solution doing and what the concept

thank you

auday1982

i wish i was clear and you know now what i mean exactly

NogDog

One way:

if(in_array($_GET['display'], array('top', 'hot', 'all'))
{
   // valid value
}
else
{
   // invalid, display error or go to default output
}

auday1982

Hello

this is a great one , thank you,

do i still have to check for xss or other stuff that people use in url to break the website? or this considered secure and the input will not break the code

i hear about ppl use php codes in the url to end something and start something like delete files , delete db tables

thank you

NogDog wrote:

One way:

if(in_array($_GET['display'], array('top', 'hot', 'all'))
{
   // valid value
}
else
{
   // invalid, display error or go to default output
}

NogDog

As far as that value goes, you should not need to do anything else, assuming that in the ELSE condition you do not use the user-supplied value in any way, since it is not one of the allowed values.