What are the best practices for handling variables passed through the URL in PHP scripts?

When handling variables passed through the URL in PHP scripts, it is important to sanitize and validate the input to prevent security vulnerabilities such as SQL injection or cross-site scripting attacks. One way to do this is by using PHP's filter_input() function with the FILTER_SANITIZE_STRING flag to sanitize the input. Additionally, it is recommended to use prepared statements when interacting with a database to further protect against SQL injection. 

// Sanitize and validate input from URL
$variable = filter_input(INPUT_GET, 'variable', FILTER_SANITIZE_STRING);

// Use prepared statement to interact with database
$stmt = $pdo->prepare("SELECT * FROM table WHERE column = :variable");
$stmt->bindParam(':variable', $variable);
$stmt->execute();

Keywords

$_GET $_POST URL parameters data validation security vulnerabilities

Related Questions