What are the potential pitfalls of using _GET variables in PHP when manipulating URLs?

Potential pitfalls of using _GET variables in PHP when manipulating URLs include security vulnerabilities such as SQL injection and cross-site scripting attacks. To mitigate these risks, it is important to properly sanitize and validate user input before using it in SQL queries or outputting it to the browser. 

// Sanitize and validate _GET variable before using it
$id = isset($_GET['id']) ? intval($_GET['id']) : 0;

// Use prepared statements to prevent SQL injection
$stmt = $pdo->prepare('SELECT * FROM table WHERE id = :id');
$stmt->bindParam(':id', $id, PDO::PARAM_INT);
$stmt->execute();

// Output sanitized data to the browser
echo htmlspecialchars($_GET['name']);

Keywords

_GET variables URLs security injection

Related Questions