如何限制用户编辑URL参数

Question

I am using CodeIgniter. When a user edits the URL parameter, I get a database error.

How can I solve this? In CodeIgniter, I am passing the value 32 in the URL

http://xyz.com/esebd2/user/link/link_detail/32

If the user edits this as shown below,

http://xyz.com/esebd2/user/link/link_detail/323434

I get a database error. What to do?

function link_detail()

    {

        $this->common_head();
        $lid = $this->uri->segment(4);
        $link_data['link_detail'] = $this->linklist->get_detail_link($lid);
            //above line to retrive value from database
        $this->load->view('user/detaillink_view', $link_data);
        $this->common_footer();

    }

Answer 1

You cannot prevent the user from editing the URL. You can only prevent that he/she has access to the resource if he/she is not authorized.

And as for the error message: Any user input should be considered as untrustworthy and should always be validated before use. Even if you don't expect the regular user to change it.

And if an error occurs, don't output the system's error message. These are only intended for the developer but not the the user as they can contain sensitive information.

Answer 2

You don't. And you can't restrict values passed on POST forms on client side too. Checks must be done server side, and have to be able to deal with all possible values.