What are the potential security risks associated with passing variables via GET in PHP, and how can they be mitigated?

Passing variables via GET in PHP can expose sensitive information in the URL, making it vulnerable to attacks such as Cross-Site Scripting (XSS) and Cross-Site Request Forgery (CSRF). To mitigate these risks, sensitive data should not be passed via GET, and user input should always be sanitized and validated before processing. 

// Example of passing variables via GET securely
if(isset($_GET['id']) && is_numeric($_GET['id'])) {
    $id = $_GET['id'];
    // Process the ID securely
} else {
    // Handle invalid input
}

Keywords

SQL injection cross-site scripting data validation input sanitization secure coding practices

Related Questions