Member Avatar for Taffd

Hi everyone,
Can anyone tell me the security issues when passing url parameters for a forum. I'm building my own forums using dreamweaver and as I understand it, using url parameters make the site susceptible to sql injection.
Regards
Taffd

  • 4 Contributors
  • 5 Replies
  • 109 Views
  • 1 Day Discussion Span
  • Latest Post Latest Post by nav33n

Dani AI

Generated

Short answer: passing data in URLs introduces several risks beyond SQL injection — leaking sensitive values in logs or referers, parameter tampering, and making CSRF or XSS easier if output isn’t handled correctly. and pointed to escaping as one layer; that helps, but security should be defensive and multi-layered. was right to flag environment and server setup as part of the picture.

Practical checklist to apply immediately:

  • Use parameterized queries / prepared statements for every DB operation instead of building SQL strings.
  • Validate and whitelist parameters server-side (cast IDs to integers, check allowed action names, enforce lengths and character sets).
  • Never put secrets (passwords, API keys, session tokens) in query strings — URLs get logged and leaked via Referer.
  • Treat GET as safe/read-only; perform state-changing operations via POST with CSRF tokens.
  • Run your DB account with least privilege (no schema-modifying rights for the web user).
  • Avoid including files or SQL identifiers directly from parameters; map user input to allowed values.
  • Add logging, rate-limiting and input-length checks to detect abuse.

Example patterns (PHP + PDO; shown for illustration of parameterized queries and whitelisting):

$pdo = new PDO($dsn, $dbUser, $dbPass, [PDO::ATTR_ERRMODE => PDO::ERRMODE_EXCEPTION]);

$id = isset($_GET['id']) ? (int)$_GET['id'] : 0;
$stmt = $pdo->prepare('SELECT id,title,body FROM threads WHERE id = :id');
$stmt->execute([':id' => $id]);
$thread = $stmt->fetch(PDO::FETCH_ASSOC);
$allowed = ['view','reply','edit'];
$action = $_GET['action'] ?? 'view';
if (!in_array($action, $allowed, true)) { /* handle error */ }

Dreamweaver-generated code is a convenience, not a security guarantee — review and replace any raw concatenation with prepared statements and strict validation. For authoritative guidance see the OWASP prevention cheat sheets and the PHP prepared-statement documentation: OWASP SQL Injection Prevention Cheat Sheet and PHP PDO prepared statements.

Recommended Answers

All 5 Replies

Member Avatar for hacker9801

For an SQL query, use something like

$var = mysql_real_escape_string(htmlspecialchars($_GET['param']));
mysql_query($var);

I dunno, that's what I use. Let a real expert tell you. :P

Member Avatar for nav33n

lol.. hacker9801 is right.. htmlspecialchars will convert html characters like >, <, & to &gt; &lt; and so on.. and mysql_real_escape_string will escape all the special characters in user's input, like, /, ', " etc..

Member Avatar for TopDogger

That's a good routine to use if your server is set up to use it properly.

mysql_real_escape_string will not work unless you are using at least PHP 4.3.0. Also, if magic quotes is turned on, you can get double backslashes.

As an alternative, you can try the following or modify it as necessary.

The function on that page is commonly used for preventing SQL injection issues.

htmlspecialchars is also good for preventing cross-site scripting.

Member Avatar for Taffd

Thanks y'all, particularly to TopDogger, for the link. Maybe I should have been a little more specific.

I'm particularly interested in whether dreamweaver written code already takes these issues into account.

In light of your answers so far, I will revisit the code and try to work it out.
Regards
Taffd

Member Avatar for nav33n

I'm particularly interested in whether dreamweaver written code already takes these issues into account.

Nope.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.