3 replies to this topic

[VakhoQ]

hello, how are you?


for example I have created web page and I have URL: www.site.com/articles.php?id=2

Now I want to hide "articles.php?id=2" I thnk, this will be good way to safe web page from SQL injections. what do you think?

[WingedPanther]

That will not protect you from SQL injections at all. You probably want to use POST instead of GET for your form method, but preventing SQL injections means validating the data on the server BEFORE you try to use it.

[Alexander]

Obfuscation (url rewriting, etc.) will never be a valid security solution.

[RHochstenbach]

What you could do is change the way you retreive the information from the URL. If you have something like this:

$id = $_GET['id'];

Change it to this:

$id = mysql_real_escape_string($_GET['id']);