$_Get

[Gene]

Weird problem... I had used the following code on a php page for months, but it seems to have stopped working, and I don't understand why.

What I want, is to simply grab the '333' (or whatever number) from the URL and place it in the body of the page. Example:

http://gapservices.com/?go=333
or
http://gapservices.com/index.php?go=333

Then this is in the body of the page where I want '333' to appear. You can't see it when you view the page source code, but it is there:

<?php
$item = strip_tags($_GET['go']);
echo $go;
?>

What am I doing wrong? Or has something changed in PHP? I can't figure out why it stopped working, when it used to work just fine. Is it the 'strip_tags' thing maybe?

 

[Jim_]

It looks like register_globals has been turned off (which is a good thing, security-wise).

Anyway, your code should probably look like this:

<?php
$item = strip_tags($_GET['go']);
echo $item;
?>

or even easier

<?php echo strip_tags($_GET['go']); ?>

 

[Eric]

If it's numerical, no need for strip_tags, just:

<?php echo intval($_GET['go']); ?>

 

[user-7256]

If it's numerical, no need for strip_tags, just:

<?php echo intval($_GET['go']); ?>

Faulty thinking... if I modify the URL and put some nasty Javascript in there on vulnerable browsers (*cough everything but Chrome cough*), I could seriously have some fun with sending people malicious links.

Always sanitize and clean user input before you use it -- http://xkcd.com/327/

Gene: Stripping tags from the get-go, huh? :D

 

[Gene]

Thanks guys! I'm stumped as to why it was working at one point then stopped... but it is working again with the revised code you gave me.

Thanks! Rep added to all


> Gene: Stripping tags from the get-go, huh?
Not quite sure what to make of that remark... but okay, yeah!

 

[Eric]

Faulty thinking... if I modify the URL and put some nasty Javascript in there on vulnerable browsers (*cough everything but Chrome cough*), I could seriously have some fun with sending people malicious links.

Always sanitize and clean user input before you use it -- http://xkcd.com/327/

Gene: Stripping tags from the get-go, huh? :D

Vulnerable browser or not, intval() would return 0 or 1 for strings in most cases.

Return Values

The integer value of var on success, or 0 on failure. Empty arrays and objects return 0, non-empty arrays and objects return 1.

The maximum value depends on the system. 32 bit systems have a maximum signed integer range of -2147483648 to 2147483647. So for example on such a system, intval('1000000000000') will return 2147483647. The maximum signed integer value for 64 bit systems is 9223372036854775807.

Strings will most likely return 0 although this depends on the leftmost characters of the string. The common rules of integer casting apply.

http://php.net/intval

String conversion to numbers

When a string is evaluated in a numeric context, the resulting value and type are determined as follows.

The string will be evaluated as a float if it contains any of the characters '.', 'e', or 'E'. Otherwise, it will be evaluated as an integer.

The value is given by the initial portion of the string. If the string starts with valid numeric data, this will be the value used. Otherwise, the value will be 0 (zero). Valid numeric data is an optional sign, followed by one or more digits (optionally containing a decimal point), followed by an optional exponent. The exponent is an 'e' or 'E' followed by one or more digits.

http://www.php.net/manual/en/language.types.string.php#language.types.string.conversion

Thanks guys! I'm stumped as to why it was working at one point then stopped... but it is working again with the revised code you gave me.

Thanks! Rep added to all


> Gene: Stripping tags from the get-go, huh?
Not quite sure what to make of that remark... but okay, yeah!

Well, like Jim_ mentioned, it looks like you were originally relying on something called register_globals where: http://www.domain.com/index.php?this=that would mean that codewise you could:

 <?php echo $this; ?>

Which would show 'that'.

With register_globals off, you have to use the superlglobals

Meaning that to achieve the above result, you'd have to use:

 <?php echo $_GET['this']; ?>

 

[user-7256]

Vulnerable browser or not, intval() would return 0 or 1 for strings in most cases.

Regardless, if you ever passed a $_GET variable that wasn't supposed to be an integer (hey, it could happen), then you need some other way to validate. And besides, you shouldn't need to use intval() in this case, since PHP is weakly-typed anyway. Albeit, good post, and good that you recognized that.