Currently, I am working on developing a sidebar search feature wherein users can select specific options by clicking them. These selected variables are then used to generate an SQL query.
Here is the process in more detail:
1. The user chooses options from the sidebar.
2. Based on these selections, a string (which serves as a URL) is created with parameters such as 'param1=value&'...
3. An AJAX call is made to a PHP controller, which passes the parameters to the model for querying the database using $_GET.
Although I do use prepared statements eventually, there is still a vulnerability where attackers could manipulate the URL. To mitigate this risk, I have defined an array of allowed values ($keysArr). If any $_GET variables are not within this array, the script terminates. Additionally, I apply int() to expected numeric values to trigger an error if they are not integers.
$keysArr = ['x', 'y', 'z'];
foreach ($ArrfromGET as $key => $value) {
if (!in_array($key, $keysArr)) {
die("don't attack me");
}
}
I am uncertain if my approach is sufficient. Since the search function relies on dynamically generated values, finding a secure solution has been challenging. The code structure was inspired by the example provided here: https://www.w3schools.com/js/js_ajax_database.asp