Originally Posted by
claro
My problem is I'm using GET method in deleting my items and I don't know how to secure my data. Whenever I tried to put in my url mysite/delete?='id value here' , my data deletes even if I'm using pdo. Is there any way to prevent user from doin it? thank you.
I believe you're referring to Cross-Site Request Forgeries (or CSRF); in which the database API would have no affect on it. A security feature known as a nonce can help prevent the problems you're having by passing a unique token through the request URI (and validated on the other end with a session variable). Here's a quick example to demonstrate:
index.php
PHP Code:
<?php session_start();
$_SESSION['nonce'] = md5(mt_rand());
?>
<!DOCTYPE html>
<html>
<body>
<a href="action.php?do=delete&gid=1&id=1&ext=php&tok=<?php echo $_SESSION['nonce']; ?>">Delete Something</a>
</body>
</html>
action.php
PHP Code:
<?php session_start();
if(isset($_GET['tok']) && $_GET['tok'] === $_SESSION['nonce'])
{
#valid data
}
?>
That's one common method of preventing CSRF; the other method (if you didn't want to go through the hassle of setting up nonces) would be to handle the data via the HTTP POST method.
Reply With Quote
Bookmarks