Converting GET to POST

[Tve]

Hi,

I have an application that can callup any URL, including of course PHP, but only using the GET method. It's a bit unfortunate, since the users can see all the arguments passed to the script and could eventually attempt to hack it.

My idee would be to have the php script check is the passed arguments are GET: if so convert to POST and recall itself.

If I'm not mistaken, the arguments should only be visible for a split second, with is fine to me.

Checking if variables have been sent with GET shouldn't be that difficult, but I do not know if a php can call another php (in this case itself) by passing POST arguments.

Any suggestions?

Thanks,



AD AUGUSTA PER ANGUSTA

Thierry

 

[apatterno]

First of all, you can see what method was used by using $_SERVER['REQUEST_METHOD'].

But hiding the GET vars from the user is a bit of work. Usually the only way to change what's in the address bar is to redirect to a new page. But if you redirect, you can't use POST, only GET. So you still have that problem. Perhaps there's a better way!

You mentioned being concerned that people could see the variable names and that this could be a security risk. Though, hackers will likely be using a packet sniffer, in which case they'd see the POST vars too.

I don't think it's that bad to have GET vars in plain view (after all, Tek-tips does it)... but if you want to obfuscate them, perhaps the user agent could base64_encode the variable values, and your script could decode them.

_{I REALLY hope that helps.}
Will

 

[Tve]

Will,

Maybe I am a bit parano.

I have no control on the user agent.

I suppose I could put the arguments in the session variable and then recall itself....



AD AUGUSTA PER ANGUSTA

Thierry

 

[tviman]

Can you change the application to POST?

There's always a better way. The fun is trying to find it!