rewriting URLs

[Gordan]

Hi,

here's my problem. On my pages I have URL souch as these
"page.php?id=2& subpage=3&param =65". For security reasons I would like to add
another parameter. It would be created like this
md5($param1.$pa ram2.$some_cons tant). I would then add that MD5 string to my URL
and stop users from altering URL manually.
I would like PHP to rewrite all my URLs in a page adding this string to each
URL. I thought that I can pass a custom function to the session URL rewriting
but I cant it just adds the session ID. I know about
output_add_rewr ite_var('var', 'value'); but the $value is fixed and in my case
it should depend on the specific URL being rewritten.
I know I could cache all my output and then write a regular expression to
rewrite URLs but that just seems slow and wrong :-)

any help is highly appreciated
gordan

[Alvaro G Vicario]

Re: rewriting URLs

*** Gordan wrote/escribió (Thu, 16 Jun 2005 13:43:55 +0200):[color=blue]
> here's my problem. On my pages I have URL souch as these
> "page.php?id=2& subpage=3&param =65". For security reasons I would like to add
> another parameter. It would be created like this
> md5($param1.$pa ram2.$some_cons tant). I would then add that MD5 string to my URL
> and stop users from altering URL manually.[/color]

Then you should be using a more secure mechanism, such as sessions. URL
parameters are useful when user cannot break anything or even is encouraged
to alter it.


--
-- Álvaro G. Vicario - Burgos, Spain
-- http://bits.demogracia.com - Mi sitio sobre programación web
-- Don't e-mail me your questions, post them to the group
--

[R. Rajesh Jeba Anbiah]

Re: rewriting URLs

Gordan wrote:[color=blue]
> here's my problem. On my pages I have URL souch as these
> "page.php?id=2& subpage=3&param =65". For security reasons I would like to add
> another parameter. It would be created like this
> md5($param1.$pa ram2.$some_cons tant). I would then add that MD5 string to my URL
> and stop users from altering URL manually.
> I would like PHP to rewrite all my URLs in a page adding this string to each
> URL. I thought that I can pass a custom function to the session URL rewriting
> but I cant it just adds the session ID. I know about
> output_add_rewr ite_var('var', 'value'); but the $value is fixed and in my case
> it should depend on the specific URL being rewritten.
> I know I could cache all my output and then write a regular expression to
> rewrite URLs but that just seems slow and wrong :-)[/color]

You seems to be right. AFAIK, the better option is
<http://in.php.net/ob_start> and <http://in.php.net/preg_replace>--yes,
it's slow.

--
<?php echo 'Just another PHP saint'; ?>
Email: rrjanbiah-at-Y!com Blog: http://rajeshanbiah.blogspot.com

[saintexupery]

Re: rewriting URLs

hi gordan.
i believe what you are trying to do is to "encrypt" your URL's so users
can`t mess with parameters.
once i did a script which did exactly that. i can't copy&paste here but
i'll give you some VERY basic pointers (it's a simple script but very
hard to explain here!).
i created 2 pages: a.php and z.php. a.php created the "encrypted" links
and z.php read them.
a.php converted automatically the URL's to the new "encrypted" format
using Output Buffering, a simple preg_replace() function and another
function to encrypt the parameters.
the preg function returned the parameters of the URL's (i.e.
?p1=v1&p2=v2) and the "encrypting " function transformed those
parameters using base64 encode.
z.php receieved the new parameter and "uncrypted" it using base64
decode and then parsed the result to make a new $_GET array.

[Gordan]

Re: rewriting URLs

A tada saintexupery rece:[color=blue]
> i believe what you are trying to do is to "encrypt" your URL's so
> users can`t mess with parameters.[/color]

exactly that! :-)

<cut>
thanks for the idea. I was just wondering if I have to use output buffering. I
know I can change every single link in my page into
encode_this_lin k('xxx.php?id=4 '); but that would take timeeeeeeee and I want
something automatic.
Ill write something using output buffering and regular expressions

thanks!
gordan

[Chung Leong]

Re: rewriting URLs

I don't see anything particularly insecure with the design. He's
basically attaching a digital signature of the GET parameters. If the
objective is simply to stop people from going to arbituary pages, it
would work.

[Alvaro G Vicario]

Re: rewriting URLs

*** Chung Leong <chernyshevsky@ hotmail.com> wrote/escribió (17 Jun 2005
08:39:54 -0700):[color=blue]
> If the objective is simply to stop people from going to arbituary pages,
> it would work.[/color]

I enclose "Going to arbitrary pages" in the "cannot break anything"
category.


--
-- Álvaro G. Vicario - Burgos, Spain
-- http://bits.demogracia.com - Mi sitio sobre programación web
-- Don't e-mail me your questions, post them to the group
--