Hiding PHP Parameters

[candeos]

Hello

We are using PHP to develop a commercial web site. I was wondering if there was a way ( like ASP) to encrypt the parameters.. ex

http://www.mydomain.net/find.php?date="1/25/02&place&"home"

Instead

http://www.mydomain.net/find?r=838848858832

I know that Zend encrypts the entire code is this the only way to go?

Any suggestions?

Thanks

Dave

 

[rycamor]

There are several ways to do this with PHP. Do you need it for security purposes, or just to make the URL less "readable"? -------------------------------------------

Big Brother: "War is Peace" -- Big Business: "Suspicion is Trust"
(

http://www.cl.cam.ac.uk/~rja14/tcpa-faq.html)

 

[candeos]

Actually a little bit of both. Our primary goal is to protect our intellectual property and to not allow people to see how we are doing things

Thanks for the reply and look forward to hearing more

Dave

 

[BB101]

you could just base64encode things... its simple and not-hack proof, but for joe bloggs its good enough --BB

 

[rycamor]

Well, think about it: there is no way to really hide what variables the browser is sending to the server. What happens on client-side space is wide open. How do you prevent users from seeing variables that are set in forms, etc...?

Now, if you are talking about hiding "accumulated" variables that go with the user from page to page, then you shouldn't be sending them through the browser anyway. Read about sessions (

http://php.net/session).

This allows you to keep the variables on the server side, and simply send a unique identifier, which can be set in a cookie, or on the URL, which might look like

http://server/page.php?PHPSESSID=d5e8f95f9736d3fa2dd2ca67492780f4

Additionally, if you are concerned about security at all, you should use SSL for everything, which will minimize the chance of people hijacking session keys.

Another step you can take is to make sure that all variable names inside your PHP code are different from form element names. Run every form through a small script which validates it and uses different names for the rest of your PHP code. (Setting register_globals = Off in php.ini is very helpful, also). This will minimize the possibility of hackers guessing your internal structure and naming conventions. -------------------------------------------

Big Brother: "War is Peace" -- Big Business: "Suspicion is Trust"
(

http://www.cl.cam.ac.uk/~rja14/tcpa-faq.html)