[FX.php List] re: Obscuring the recid on URL links

[John Lannon]

This is a good question. I'm not really sure there's a secure way to submit
sensitive data via URL. In any case, I think to access FMP via HTTP GET,
you'll have to supply some arbitrary key, so you could always key on a
unique serial key field in the database that doesn't correspond to the
recid. Armed with an arbitrary value from an unspecified column in your
database, I doubt a malicious user could do a whole lot of damage. However,
I guess it could still be problematic if the user was evil enough.

You could use PHP's mcrypt functionality to encrypt the recID in the URL,
then decrypt it in  your recieving script.
http://www.php.net/manual/en/ref.mcrypt.php.

The more secure solution would be to only use HTTP POST for page navigation.


Hope this is of some help.

Message: 5
Date: Fri, 25 Aug 2006 09:40:30 -0700
From: Jonathan Schwartz <jonathan at eschwartz.com>
Subject: [FX.php List] Obscuring the recid on URL links
To: "FX.php Discussion List" <fx.php_list at mail.iviking.org>
Message-ID: <p06200704c114d673d551@[192.168.1.101]>
Content-Type: text/plain; charset="us-ascii" ; format="flowed"

I feel that I should know this by now, but still have a question on
how to create links that do not reveal recid's in URL links.

I understand how to use hidden input fields to hide recids on forms.
No problem there.

However, on links that use URLs (list.php?recid=12345), what methods
are used to not review the recid?

I did try a method where I use 20 character randomly generated ID
instead of the recid, and it works fine.  The 20 character ID still
appears in the URTL, but with 20 characters, it represent a security
risk...I think.

Am I missing some basic concept or technique in this area?

Thanks

Jonathan

<http://www.exit445.com/>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://www.iviking.org/pipermail/fx.php_list/attachments/20060825/7eb70abf/attachment-0001.html