防止GET参数注入

Question

I am new to php development and have been reading up on general security. I have an app which communicates with a PHP back end by posting parameters through a URL which is then processed on the server.

An example:

http://www.myserver.com/addcredit=99

However I'm sure I am correct in thinking that this is vulnerable, someone could maliciously inject their own parameters and add their own credit?

How would I protect against this and are there any useful materials people would recommend I look at to get a good understanding of security fundamentals in general?

thanks

Answer 1

Do not use database ids for the credit card id. It makes it easy for users to access other users credit cards.

Use a random string that uniquely identifies the credit card

Answer 2

在这种情况下，您可以使用一些简单的清理方法：

$addcredit = intval($_GET['addcredit']);