What are the potential pitfalls of using variable URLs in PHP scripts?

Using variable URLs in PHP scripts can potentially introduce security vulnerabilities such as SQL injection attacks or cross-site scripting (XSS) attacks. To mitigate these risks, it is important to sanitize and validate any user input that is used in constructing URLs. 

// Sanitize and validate user input in variable URLs
$id = isset($_GET['id']) ? intval($_GET['id']) : 0;
if ($id <= 0) {
    // Invalid ID, handle error or redirect
    header('Location: error.php');
    exit;
}

// Use the sanitized ID in your script
$query = "SELECT * FROM table WHERE id = $id";
// Execute query and proceed with the rest of the script

Keywords

variable URLs PHP scripts security vulnerabilities SQL injection data validation

Related Questions