What are the potential pitfalls of replacing ID values with user names in URLs in PHP?

Replacing ID values with user names in URLs can potentially expose sensitive information about users, such as their usernames, which can be a security risk. It can also lead to URL manipulation and make it easier for malicious users to guess and access other user's profiles. To solve this issue, it's recommended to use unique identifiers (such as user IDs) in URLs instead of user names. 

// Example of using user IDs in URLs instead of user names
// Original URL: example.com/profile.php?user=johndoe
// Updated URL: example.com/profile.php?user_id=123

$user_id = $_GET['user_id'];

// Fetch user data based on user ID
$query = "SELECT * FROM users WHERE user_id = :user_id";
$stmt = $pdo->prepare($query);
$stmt->bindParam(':user_id', $user_id);
$stmt->execute();
$user = $stmt->fetch();

// Display user profile information
echo "Username: " . $user['username'];

Keywords

security SQL injection data validation URL rewriting user authentication

Related Questions