Do you validate your URL variables?
server-side, url, validation
Solution
Yes. Without a doubt. Never trust user input.
To improve the user experience, input fields can (and IMHO should) be validated on the client. This can pre-empt a round trip to the server that only leads to the same form and an error message.
However, input must always be validated on the server side since the user can just change the input data manually in the GET url or send crafted POST data.
In a worst case scenario you can end up with an SQL injection, or even worse, a XSS vulnerability.
Most frameworks already have some builtin way to clean the input, but even without this it's usually very easy to clean the input using a combination of regular exceptions and lookup tables.
- Say you know it's an integer, use int.Parse or match it against the regex "^\d+$".
- If it's a string and the choices are limited, make a dictionary and run the string through it. If you don't get a match change the string to a default.
- If it's a user specified string, match it against a strict regex like "^\w+$"
Problem
When you're passing variables through your site using GET requests, do you validate (regular expressions, filters, etc.) them before you use them? Say you have the URL http://www.example.com/i=45&p=custform. You know that "i" will always be an integer and "p" will always contain only letters and/or numbers. Is it worth the time to make sure that no one has attempted to manipulate the values and then resubmit the page?