Hello, just a few small questions regarding an already-existing site.
For SEO purposes and basic aesthetics (I can see the benefit of doing it the long way) I was looking at converting the current URL we use:
To:
sitename.com/news/news-title-goes-here
My first issue is the security implications of accessing the database with a passed variable. Using an int I could declare that the variable MUST be an int, it’s a bit harder with a string. This is my current code.
function displayNews2() {
if (isset($_GET['newsid'])) {
$pageID = str_replace(array('-'),' ',$_GET['newsid']);
echo $pageID;
$result = mysql_query("SELECT * FROM news WHERE news_title='$pageID' ORDER by news_created DESC") or die(mysql_error);
$row = mysql_fetch_array($result);
$newsID = stripslashes($row['news_id']);
$newsTitle = stripslashes($row['news_title']);
$newsDate = stripslashes(date('M d, Y', $row['news_created']));
$newsAuthor = getAuthor(stripslashes($row['author_id']));
//$newsContent = str_replace(array('\\r', '\\r\
', '\
'),'<br />',$row['news_content']);
$newsContent = nl2br(stripslashes($row['news_content']));
echo "<div id='newsBlog'>
<h4>$newsTitle </h4>
<div class='blogContent'>
<p>$newsContent</p>
<span>Posted $newsDate by $newsAuthor<br/>
<a href='compensation-news.php'>Read More Claim News</a></span>
</div>
</div>";
}
}
I have changed this ti accept a string and it works, entering anything else at the minute just has it return an error (I’ll add an else later).
Is that good enough to secure against malicious code because it seems dangerous to me personally. Should I be passing the variable into $pageID and then running stripslashes et al. on it because my concern there is making the string ineligible for then recovering it from the database.
I don’t think there is another way to include the title in the URL short of including the title in the URL.
My second issue is thus. I put my current dynamic URL into a code generator which would generate the htaccess code I need in order to change the appearance of these particular URL’s. This is what I put in:
sitename.co.uk/test.php?newsid=Grabbed-Cyclist-Wins-£12,000-In-Compensation
This is what I get back:
sitename.co.uk/test/newsid/(Any Value)/
Ignoring the ‘test’ part which would probably be news or compensation-news in practice, the ‘newsid’ part seems ugly and other sites I’ve observed don’t seem to have this extra /variable as part of their URL structure.
Am I missing something here? I can change the variable name but if possible I’d really prefer the URL to just be “sitename.co.uk/news/news-title/”
It’s a bit of a nuisance but I think it will look better and work better for the effort put in but I defer to the experts in this area.
Sorry if this was a little long to read but thanks for reading if you got this far.
DWB
