Send header 404 if id != $_get['id']

Question

SQL query like this,

$uid = $_GET['id'];
$result = mysql_query("SELECT name, lastname, email FROM users WHERE id = '$uid'");

How to print a 404 header if the id != value of $_GET['id']?

@AndyPerlitch I thought the mysql_ library didn't allow chained queries like that? — John V., Aug 20 '12 at 23:48
@AndyPerlitch, didn't get you solution sorry, where should that code be placed? — Johan Larsson, Aug 20 '12 at 23:52
@JohanLarsson That's not a solution. He's pointing out a vulnerability in your code know as SQL injection. — Steve Robbins, Aug 20 '12 at 23:52
@stevether, that's right, my code is not production ready yet, I know I have to think about that. by the way thank about that Bobby Tables ;) — Johan Larsson, Aug 21 '12 at 00:02

score 4 · Accepted Answer · edited May 19 '14 at 23:07

4

$uid = mysql_real_escape_string($_GET['id']);
$result = mysql_query("SELECT name, lastname, email FROM users WHERE id = '{$uid}'");
if (!result || mysql_num_rows($result) == 0)
    header("Status: 404 Not Found");

Also note, you should move away from deprecated mysql_* functions.

Also also note, Bobby Tables.

edited May 19 '14 at 23:07

BenMorel

34,448
50
182
322

answered Aug 20 '12 at 23:45

Steve Robbins

13,672
12
76
124

I'm getting an error, Warning: Cannot modify header information - headers already sent... at the same line where I placed the code. (You are on the right track for solving the issue) – Johan Larsson Aug 20 '12 at 23:51
If you're using PHP 5.4 you can also use `http_response_code()` http://www.php.net/manual/en/function.http-response-code.php. – JamesArmes Aug 20 '12 at 23:51
@JohanLarsson That's a separate issue. http://stackoverflow.com/questions/8028957/headers-already-sent-by-php – Steve Robbins Aug 20 '12 at 23:52
"Move away from" is a polite way of saying "You should never have used them in the first place" because they're extremely dangerous if not used correctly, and way too easy to use incorrectly. It would not be a bad idea to rip out all your `mysql`-based code and replace it with `mysqli` or PDO right now because you will have to do this eventually anyway. – tadman Aug 21 '12 at 06:28

score 1 · Answer 2 · answered Aug 20 '12 at 23:44

1

Not really sure which id you refer to, but you are looking for something along the lines of:

if (id != $_GET['id'])
    header("Status: 404 Not Found");

answered Aug 20 '12 at 23:44

mash

14,851
3
30
33

Send header 404 if id != $_get['id']

2 Answers2