What are the potential security vulnerabilities associated with using PHP to handle page requests with parameters like index.php?page=kontakt?

One potential security vulnerability associated with using PHP to handle page requests with parameters like index.php?page=kontakt is the risk of SQL injection attacks. To mitigate this risk, it is important to properly sanitize and validate user input before using it in database queries. This can be done by using prepared statements or parameterized queries to prevent malicious SQL code from being executed. 

// Sanitize and validate the 'page' parameter before using it in a database query
$page = isset($_GET['page']) ? $_GET['page'] : 'default';
$allowed_pages = ['home', 'about', 'contact']; // Define a list of allowed pages

if (!in_array($page, $allowed_pages)) {
    $page = 'default'; // Set a default page if the requested page is not in the allowed list
}

// Use the sanitized 'page' parameter in a database query
$stmt = $pdo->prepare("SELECT * FROM pages WHERE page_name = ?");
$stmt->execute([$page]);
$page_data = $stmt->fetch();

Keywords

SQL injection cross-site scripting (XSS) input validation parameterized queries secure coding practices

Related Questions