[RESOLVED] Is this $_GET snippet safe?

devsie

Hello,

I understand normally you need to escape $_GET details to avoid potential hacks. However, I couldn't get the following code to work when I did.

So, is it safe to leave as it is?
If not, how do I make it safe?

Many thanks.

if((in_array($row['exptype'],$GET))||(!($GET)))
{
DO STUFF
}

(Broadly speaking the code is to check if a user has selected to display a certain option/info. If the 'type' is in the query string, I'll display the 'type' of info from the mysql search. If that helps/makes sense)

Many thanks,
devsie

dagon

it does not work because your checking the array $_GET, you should be checking a specific value.

devsie

I believe i'm checking the $_GET array for a specific value.

If it's there then I know to include information relevant to that value.

Is there a problem with that? 😕

dagon

your checking the whole array that a user can easily populate, then i assume you use a specific value from the array, so why not check that specific value?

if($row['exptype']==$_GET['exptype']){
//do something
}

lets say $row['exptype'] is 'green' your checking if any value in the $GET array is 'green' when you only care about one particular value, i could add to the url &colour=green, then regardless of the value of $GET['exptype'] the if condition would be true.

You're searching the whole house when you already know what room the keys are in.

devsie

Hi Dagon,

I'll try to explain better and see if this makes sense. 🙂

Simplified example.
The DB has stored an amount (the price) and the type of sale (e.g drink OR food).

On this page, the user selects using a checkbox which type of sale they want to display. Either, drink, food, other, both or whatever combination they need.

After the form is submitted the piece of code in question comes into play.
If they've checked an option it appears in the $GET array & it knows to print that row from the DB. If they haven't it knows to ignore that option from the DB.

So the query string will look something like
.php?food=on&drink=on

There is no $_GET['exptype'] as there is no exptype= in the querystring.

I may well be approaching this all backwards. I do have a tendency to do that as a self taught amateur coder.

All advice is appreciated. Thank you.

devsie

Ahh. I've tried again refreshed today and I've found how to escape it and improve safety. Not sure what I overlooked last night, but it was late.

However, still interested in the discussion to see if there was a better way of approaching it.

~devs