隐藏数据库来源的PHP URL参数并防范XSS攻击

Hey there! Let's tackle both your XSS vulnerability and parameter hiding issues step by step—perfect for a PHP beginner to follow along.

一、先搞定XSS漏洞 #

Your current code directly outputs database values like league_name and joincode into URLs and page text, which is exactly how XSS attacks happen. We need to use targeted escaping functions for different scenarios:

• For URL parameters: Use urlencode() to encode special characters (like <, >, &) so they don't get interpreted as malicious script in the URL.
• For HTML text output: Use htmlspecialchars() to escape characters that have special meaning in HTML, preventing browsers from executing injected code.

Here's your code with XSS fixes applied:

<?php 
if ($result = $link->query("SELECT league_name, role, start_date, end_date, joincode, active FROM leagues WHERE unique_id='$unique_id'", MYSQLI_USE_RESULT)) {
    while($row = $result->fetch_assoc()){ 
?> 
<tbody> 
    <tr> 
        <td scope="row" data-label="League Name">
            <a class="action" href="leagueinfo.php?league_name=<?php echo urlencode($row['league_name']); ?>&joincode=<?php echo urlencode($row['joincode']); ?>">
                <?php echo htmlspecialchars($row['league_name']); ?>
            </a>
        </td> 
    </tr> 
<?php 
    } 
    $result->close(); 
} 
mysqli_close($link); 
?> 
</tbody> 
</table>

二、隐藏URL中的敏感参数（更安全的长期方案） #

Exposing league_name and joincode directly in URLs isn't just a XSS risk—it can leak sensitive info too. A better approach is to only pass a unique identifier (like your league's database primary key id, or the existing unique_id) in the URL, then fetch the full details from the database on the target page.

Step 1: Update the list page to use a unique ID #

Assuming your leagues table has an auto-increment primary key id (use unique_id if you don't have a primary key), modify the link to pass this ID instead:

<?php 
// Make sure to select the id (or unique_id) in your query
if ($result = $link->query("SELECT id, league_name, role, start_date, end_date, joincode, active FROM leagues WHERE unique_id='$unique_id'", MYSQLI_USE_RESULT)) {
    while($row = $result->fetch_assoc()){ 
?> 
<tbody> 
    <tr> 
        <td scope="row" data-label="League Name">
            <a class="action" href="leagueinfo.php?league_id=<?php echo htmlspecialchars($row['id']); ?>">
                <?php echo htmlspecialchars($row['league_name']); ?>
            </a>
        </td> 
    </tr> 
<?php 
    } 
    $result->close(); 
} 
mysqli_close($link); 
?> 
</tbody> 
</table>

Step 2: Fetch data by ID in leagueinfo.php #

On the target page, use the league_id parameter to query the database. Always use prepared statements here to avoid SQL injection:

<?php
// Connect to your database (assuming $link is already set up)
if (!isset($_GET['league_id']) || !is_numeric($_GET['league_id'])) {
    // Handle invalid requests—redirect back to the list page, for example
    header("Location: your_leagues_list_page.php");
    exit;
}

$league_id = intval($_GET['league_id']);

// Use a prepared statement to fetch league details
$stmt = $link->prepare("SELECT league_name, joincode FROM leagues WHERE id = ?");
$stmt->bind_param("i", $league_id); // "i" means the parameter is an integer
$stmt->execute();
$result = $stmt->get_result();
$league = $result->fetch_assoc();

if (!$league) {
    // Handle cases where the league doesn't exist
    echo "League not found!";
    exit;
}

// Now you can safely use the league data
echo "League Name: " . htmlspecialchars($league['league_name']);
echo "Join Code: " . htmlspecialchars($league['joincode']);

// Clean up resources
$stmt->close();
mysqli_close($link);
?>

Bonus: Fix SQL injection in your original query #

Your current query SELECT ... WHERE unique_id='$unique_id' is at risk of SQL injection. Swap it for a prepared statement too:

// Replace your original query code with this
$stmt = $link->prepare("SELECT id, league_name, role, start_date, end_date, joincode, active FROM leagues WHERE unique_id = ?");
$stmt->bind_param("s", $unique_id); // "s" means the parameter is a string
$stmt->execute();
$result = $stmt->get_result();

// Continue with your loop as before
while($row = $result->fetch_assoc()){
    // Output table rows
}

$stmt->close();
$result->close();

This fixes all three major security issues: XSS, exposed sensitive parameters, and SQL injection.

内容的提问来源于stack exchange，提问作者Phoebe