transferring data by get, php in the url and security

Question

Here is the first question and I need your help. I transfer form data from first page using header location method in php to second page. On the second page I accept the data using get. Now here the url of 2nd page, after the data is sent (i.e. form is submitted) http://mydomain.com/site1/form1_conf.php?id=123 When user is on second page, the data on second page is being displayed according the id number from the mysql database. Now the problem is that when the user is on second page and he changes the number (for ex. 123 to say 78) the data of id=78, from the database is displayed, which is no good. How can I stop that? Please Note: I can't use post, nor can I use sessions. EDITE: php code on first page, to transfer to second page: ``` // after all validations are okay $insert = //insert into database $result = mysql_query($insert); if($result) { echo("
Input data is succeed"); $lastInsertedId = mysql_insert_id(); header('Location:form1_conf.php?id='.$lastInsertedId); //THIS IS TH…

Accepted Answer

Your problem is not with the URLs: to a power user changing cookies or POST-variables is as trivial as editing GET-variables for a regular user. You'll need some way to 'sign' the requests as being valid.

Easiest to do this is with a "pre-shared key", which you use with one-way hashes to validate requests.

Redirector:

```
$newURL = '/newpage?id='.$id.'&hash='.sha1('mypresharedkey'.$id);
header('HTTP/1.1 303 See other');
header('Location: '.$newURL);
die;
```

The other page:

```
$idToShow = $_GET['id'];
$hash = sha1('mypresharedkey'.$id);
if($hash != $_GET['hash'])
  die("Tssss, don't play with the address bar!");
else
  RenderThePage();
```

This ensures end users can only access pages they've been allowed to by the submit.

For your specific code:

```
...all prior code
$lastInsertedId = mysql_insert_id();
$timestamp = time();
header('Location:form1_conf.php?'.http_build_query([
      'id' => $lastInsertedId,
      'time' => $timestamp,
      'hash' => sha1('some-generated-key'.$timestamp.$lastInsertedId)
]);
```

In the other page, including a timebomb if you want (otherwise just comment it out):

```
$id = $_GET['id'];
$time = $_GET['time'];
if($_GET['hash'] != sha1('some-generated-key'.$time.$id))
  die('URL was tampered with');
if(time() - $time > 300)
  die('URL was only valid for 5 minutes');
```

transferring data by get, php in the url and security

Solution

Problem