Take the 2-minute tour ×

Hi I have a web form that sends a string to one php file which redirects them to a corresponding URL. I've searched about web form hacking and I've only received information about PHP and SQL... my site only uses a single PHP file, very basic etc. Would it be open to any exploits? I'm obviously not going to post the URL, but here is some code I was working on for the php file: http://stackoverflow.com/questions/2888077/newbie-php-coding-problem-header-function-maybe-i-need-someone-to-check-my-cod


share|improve this question
I haven't looked at the link, but SQL injection possibly? –  Mitch Wheat May 23 '10 at 6:34
"obviously not"? why not? do you expect us to take down your whole server if we do find an exploit? –  Mark May 23 '10 at 6:36
We can't tell you how secure it is without seeing the code... –  David Z May 23 '10 at 6:37
I've added a link for the code above, David. Just want to make it clear that I'm not using ANY form of database. –  Haskella May 23 '10 at 6:46
I saw your link, but that's only a small snippet of the code, right? Sure, I don't see any major security risk with the bit you posted, but we can't say whether your form can be hacked without seeing all the code. (And there are plenty of security problems you could potentially have without using a database) –  David Z May 23 '10 at 8:03
add comment

3 Answers

up vote 2 down vote accepted

From that little snippet, I don't see anything dangerous. "Hackers" can enter pretty much anything they want into $_REQUEST['sport'] and thereby $searchsport, but the only place you use it is to access your array. If it's not found in your array.... nothing much will happen. I think you're safe in this limited scenario ;) Just be careful not to use $searchsport for...... just about anything else. Echoing it, or inserting it into a DB is dangerous.

share|improve this answer
Thanks for the advice, appreciate it –  Haskella May 23 '10 at 6:45
you're welcome :) –  Mark May 23 '10 at 7:24
add comment

Uh, it really depends. If you are inserting data into a MySQL DB without sanitizing, the answer is a huge yes. This is something you need to decide for yourself if you aren't going to show code.

share|improve this answer
The code is pretty much all above. The only code on the .html file is the <form> blah blah and method=post etc, I didn't think it would be necessary to show this. –  Haskella May 23 '10 at 6:48
add comment

The solution you've got in the linked question is pretty safe.
Every possible action is hardcoded in your script.

Nothing to worry about.

Though asking for the "web form like this" you'd better to provide a web form. Not the link to the question that contains a code that can be presumed as this form's handler.

share|improve this answer
Well, that's a relief thanks. Better safe than sorry :D –  Haskella May 23 '10 at 6:49
add comment

Your Answer


