如何在PHP中校验动态URL请求的数据？CMS伪静态场景

Hey there, let's tackle this step by step—first, we need to fix the critical security issue in your current code, then add proper validation for that $path variable.

First: Fix the SQL Injection Vulnerability #

Right now, you're directly concatenating $path into your SQL query, which is a huge SQL injection risk. Attackers could craft malicious URLs to steal or modify your database data. The solution here is prepared statements (parameterized queries), which separate SQL logic from user input.

Here's how to rewrite your query safely with mysqli (since your code uses $conn->query):

// Prepare the SQL statement (placeholder ? for the variable)
$stmt = $conn->prepare("SELECT * FROM post WHERE url = ?");

// Bind the $path variable to the placeholder: "s" means it's a string type
$stmt->bind_param("s", $path);

// Execute the query
$stmt->execute();

// Get the result set
$result = $stmt->get_result();

// Clean up
$stmt->close();

This way, the database treats $path as pure data, not part of the SQL command—no injection possible.

Second: Validate the $path Request Data #

Validation ensures the incoming $path matches the format you expect, blocking invalid or malicious input before it even reaches your database. Here are key checks to implement:

• Block empty or invalid paths: Reject empty values to avoid unnecessary database queries.
• Prevent path traversal: Block ../ or ..\ which could be used to access unintended files (even though your .htaccess routes to index.php, it's still a good guard).
• Restrict allowed characters: Only let through characters that make sense for your post URLs (e.g., letters, numbers, hyphens, underscores, slashes, dots).
• Limit input length: Prevent excessively long paths that could cause issues.

Here's a reusable validation function you can use:

function validateRequestPath($path) {
    // Reject empty paths
    if (trim($path) === '') {
        return false;
    }

    // Block path traversal attempts
    if (strpos($path, '../') !== false || strpos($path, '..\\') !== false) {
        return false;
    }

    // Allow only valid URL path characters (adjust regex based on your needs)
    $allowedPattern = '/^[a-zA-Z0-9\-_\/\.]+$/';
    if (!preg_match($allowedPattern, $path)) {
        return false;
    }

    // Limit path length to a reasonable maximum (e.g., 255 characters)
    if (strlen($path) > 255) {
        return false;
    }

    return true;
}

How to Use the Validation #

Add this check before your database query:

// Get the path from the request (make sure to sanitize if needed)
$path = isset($_GET['path']) ? $_GET['path'] : '';

// Validate the path
if (!validateRequestPath($path)) {
    // Return 404 for invalid requests
    http_response_code(404);
    echo "Page not found";
    exit;
}

// Proceed with the prepared SQL query from earlier

Extra Tips #

• Return appropriate HTTP codes: Use 404 for invalid paths, 403 for forbidden requests, etc.—this helps search engines and users understand what's wrong.
• Normalize the path: If your post URLs are case-insensitive, convert $path to lowercase (e.g., $path = strtolower($path);) to avoid duplicate logic.
• Whitelist valid paths (optional): If you have a fixed set of allowed URLs, you could compare $path against a pre-defined list for an extra layer of security.

内容的提问来源于stack exchange，提问作者Utpal Sarkar