Rewriting URL and attacks

PHP
1

Hi,

I use mod_rewrite for URL rewriting. get different sections address by preg_match:
This approach itself brings security in some cases.

preg_match('#^/(\d+)/(\d+)/([^/]+)$#', $path, $matches)

The third section is open to all non-numeric characters.
Is it possible to mysql inject or attack to browser client?
Is there a way to clean it; for better security? (I mean $matches[3])
Thanks

2

Your SQL should be prepared/escaped at the point where you create the query itself, regardless of whether you rewrite URLs or not. So no, URL rewriting is not the cause of, nor the appropriate solution to, SQL injection.

3

Thanks,

I’m use $matches[3] to show title article in url and not have any query according to $_get $matches[3]. Is it risk? other query prepared.

4

If
$_get $matches[3]
can be anything I think you best do some validation / sanitization with it before it gets near your query.

5

Thansk,

Explicitly ask: Can complete query for drop or delete sent via this parameter ($_get $matches[3])

I’m use $matches[3] to show title article in url and not have any query according to $_get $matches[3]

6

This topic was automatically closed 91 days after the last reply. New replies are no longer allowed.