What potential security risks are involved in allowing users to input IDs for file downloads in PHP, and how can these risks be mitigated?

Allowing users to input IDs for file downloads in PHP can pose security risks such as SQL injection attacks, directory traversal attacks, and unauthorized access to sensitive files. To mitigate these risks, it is important to validate and sanitize user input, use prepared statements for database queries, and restrict access to files based on user permissions. 

// Example of validating and sanitizing user input for file download
$id = isset($_GET['id']) ? $_GET['id'] : null;

// Validate input
if (!is_numeric($id)) {
    die("Invalid ID");
}

// Sanitize input
$id = filter_var($id, FILTER_SANITIZE_NUMBER_INT);

// Use prepared statement to fetch file information from database
$stmt = $pdo->prepare("SELECT * FROM files WHERE id = :id");
$stmt->bindParam(':id', $id, PDO::PARAM_INT);
$stmt->execute();
$file = $stmt->fetch();

// Check if file exists and user has permission to download it
if ($file && $user->hasPermission($file['user_id'])) {
    // Download file
    header('Content-Type: application/octet-stream');
    header('Content-Disposition: attachment; filename="' . $file['filename'] . '"');
    readfile($file['path']);
    exit;
} else {
    die("Unauthorized access");
}

Keywords

SQL injection cross-site scripting (XSS) file path traversal input validation file permissions.

Related Questions