Databases
StackOverflow2013
Postsdbo
POHow to Secure My Code
 

Note that there are some explanatory texts on larger screens.

plurals
  1. POHow to Secure My Code
    primarykey
    data
    text
    <p>I'm writing a simple web-based site for a company to display products on their site. It needs to be fairly easy to maintain. I'm not able to use a database. I'm using a multidimensional array to store the product information and retrieving it with a <strong>product key</strong>.</p> <p>My main concern is security. I have a very limited amount of time I can spend on this - so, I don't have the bandwidth to build anything more serious. If you see anything that looks obviously bad, please let me know how I can patch it.</p> <p>Here is an example URL with the product key: <a href="http://example.com/products.php?productKey=widget" rel="nofollow">http://example.com/products.php?productKey=widget</a></p> <p>Here is the code that gets the product key, verifies it's valid, and retrieves the product information:</p> <pre><code>// obtain merchandise variables include 'merch.vars.php'; // assign a default value $productKey = 'placeholder'; // check to see if a value was passed if (isset($_GET["productKey"])) { // create array of product keys $productArrayKeys = array_keys($product); // check if value passed to page exists in product key array if (in_array($_GET["productKey"], $productArrayKeys)) { // value exists - assign to $productKey $productKey = $_GET["productKey"]; } } </code></pre> <p>Here is an example of the product multidimensional array:</p> <pre><code>$product = array( "placeholder" =&gt; array( item_title =&gt; "Placeholder Title", item_image_url =&gt; "placeholder.png", item_price =&gt; "0.00", item_description =&gt; "Placeholder Description", item_quantity =&gt; 1, product_icons =&gt; false ), "widget" =&gt; array( item_title =&gt; "Product Title", item_image_url =&gt; "widget.png", item_price =&gt; "15.00", item_description =&gt; "Product Description", item_quantity =&gt; 1, item_category =&gt; array( small =&gt; "Small", medium =&gt; "Medium", large =&gt; "Large", Xlarge =&gt; "XLarge" ), product_icons =&gt; true ) ); </code></pre>
    singulars
    1. PO
      singulars
      1. PTAnswer
    1. This table or related slice is empty.
    1. PTQuestion
    1. This table or related slice is empty.
    1. USw0lf42
    plurals
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. PO
      singulars
      1. PTAnswer
    2. PO
      singulars
      1. PTAnswer
    1. VO
      singulars
      1. POHow to Secure My Code
      1. This table or related slice is empty.
      1. VTUpMod
    1. COWhat type of attacks do you need to defend against? For example, is it a problem if an attacker guesses a product key for a product that the site didn't tell them about? Nothing in the code you posted actually *does* anything with lasting effects so it's hard to guess what sort of effects are acceptable vs. undesired.
      singulars
      1. POHow to Secure My Code
      1. USWyzard
    2. COWithout a database, and likely without an authentication system, I don't see many possible breaches...This part you posted looks "secure", though. Sidenote: how many products are there? Are you sure this approach will be "fairly easy to maintain" ?
      singulars
      1. POHow to Secure My Code
      1. USDamien Pirsy
    3. COyou use php arrays... and SQL injections and data corruption is not possible as long your php file that has the arrays is still alive
      singulars
      1. POHow to Secure My Code
      1. USMp de la Vega
 

Querying!

 
Guidance
A row detail

Detail views are divided into sections. All the information in the data section comes from columns in the selected row. The other sections display data from other, related rows.

Related data can be related in a to-one or a to-many fashion. Captions of data related in a to-many fashion link to a list view showing a filtered view of the table.

Try moving around until you find a non-empty to-many entry and click on the label to get to one. You can move back to the root by clicking on the database name in the header.

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload