0

I have a php website. The first page contains a list of products and I'm currently passing the ID (picked up from mysql database) for the product within the URL to the items page i.e. localhost/item.php?4

I don't want to show any parameters in the URL so have investigated another option which is using a session.

The issue with this is that the link to each of my items is in a while loop retrieving ID and product name from the database so I'm having issues making the session mirror the ID when an item/link has been clicked.

Here's a snippet of my code (I've removed the session code):

$stmt = $con->prepare("SELECT pid, product_name FROM persons where deleted = ? order by order_age desc");
$stmt->bind_param("i", $del);
$stmt->execute();
$result = $stmt->get_result();

if ($result->num_rows > 0) {
// output data of each row
while($row = $result->fetch_assoc()) {

    echo '<tr><td>';
        $phn = $row["pid"];
        echo "<span><a class='storage' href='item.php'>" . $rows["product_name"] . "</a></span>";
}
echo "</td></tr>";
}

I guess I have two questions:

  1. Is it possible to achieve what I need to do
  2. What is the correct way of achieving this

Thanks in advance, Pete

Pman
  • 13
  • 2
  • Why do you want to do that? It's important for user experience that someone can save a link to an item, and get back to that item later. – Niet the Dark Absol Mar 17 '20 at 17:36
  • The main purpose is just to hide my long URL. The code I embedded is an example but I have URL's which pass multiple parameters. My understanding also, is if a session can be used, the user can always go back to the page with correct information as the page would be refreshed using the session variable. – Pman Mar 17 '20 at 17:41

1 Answers1

0

Options, briefly

  • You could first load /item.php?id=4 then redirect to /item-hidden.php & use $_SERVER['HTTP_REFERER'] & parse_url & process the GET portion of the referrer url.

  • You could also use session for this. Set the session variables when the page loads to the long-url, then redirect to the short url, load the session & clear the session.

  • If you just want to shorten the url, then you could use uniqid() And put the unique id in the url & save the paramaters to a session variable with that unique id.

  • You could use a pre-made url shortener.

  • You could roll your own url shortener using a reference file that holds an array or a database.

  • There are surely other creative solutions that I haven't thought of

My thoughts:

  • Hiding the url altogether will make for a poor user experience - inability to bookmark, using the back-button will be funky, hard to share an item on social media or a blog
  • Shortening the url is nice but not necessary
  • Depending on the options you're working with, you might be able to create shorthands that are more friendly to look at in the url bar or db-references for sets of options that are extremely common
  • What you're trying to do seems like a great learning project - learn about sessions, http_referer, databasing & whatnot. I think by doing what you're wanting, you'll learn that you don't really like how it feels - or you might come up with a clever way to make your URLs prettier & make the UX really nice.
Reed
  • 14,703
  • 8
  • 66
  • 110
  • 1
    Thanks for your message. It is definitely a learning curve, this is my first proper project :) The other concern I have is that the ID's in the URL's can be changed etc. Not sure if there are any security issues around these being exposed. – Pman Mar 17 '20 at 18:07
  • I don't think exposing a lookup-id in the url is really a problem. You might notice that every StackOverflow post has a numeric ID in the url. As long as the ID doesn't contain any meaning that shouldn't be public, then it should be okay. There are plenty of things to do to properly secure your server, but hiding information that's necessary to fulfilling a request is not one of them IMO. You could also use PHP to encrypt & decrypt the ID so the raw id is never seen. Or you could use hashing. https://stackoverflow.com/q/16600708/ I am not a security expert. – Reed Mar 17 '20 at 19:22