how to protect an ID in the url with php?

Question

For a simple mailinglist, i use flat-file (.txt) files for storing the date from subscribers. The name of the .txt files is the same as the id i assign to a subscriber. A .txt file with the data inside (name and email) looks so something like this: id-8759874589.txt In every email i send, i send an unsubscribe link so that the subscriber can unsubscribe from receiving mails. I encode the unsubscribe link with base64_encode . Only for the mask of the eye. An unsubscribe-link looks something like this:

http://example.com/unsubscribe.php?id=aWQtMjAxOTEyMjMNDUyMTQ%3D&email=amNtZy5tYWVzc2VuQGdtYWlsLmNvbQ%3D%3D

For unsubscribing, i use this code:

<?php
    $id = $_GET['id'];
    $email = $_GET['email'];
    // decode the id and email string
    $id_decode = base64_decode($id);
    $email_decode = base64_decode($email);
    if( isset($id_decode) ) {   

        $filename = 'subscribers/'.$id_decode.'.txt';   
        // delete subscribers entry
        if(file_exists($filename)) { 
            unlink($filename);  
            echo '<div class="alert alert-success"><b>'.$email_decode.'</b> is successfully removed from our mailinglist!</div>';       
        }
        else {
            echo '<div class="alert alert-danger">Email not found or you already have unsubscribed from our mailinglist!</div>';
        }       
    }
    ?>

As you can see: the id , which is assigned to the .txt file, will be unlinked. The subscriber is deleted from the mailinglist.

My worries: Lets say: you were a subscriber and you did unsubscribe, then you know how the url is created. You can start guessing: How will the subscriber be unsubscribed? Lets say: you know that every subscriber has his data in a .txt file with the name of the id. You can let a robot guess the identities in the url string and execute this url. In worse case scenario , he found an id that really exists and the file will be deleted. A random subscriber is removed from the list without doing itself.

How can i protect this better?

Answer 1

Create a unique code and store this code in the file, also provide this code in unsubscribe url:

http://example.com/unsubscribe.php?id=aWQtMjAxOTEyMjMNDUyMTQ%3D&email=amNtZy5tYWVzc2VuQGdtYWlsLmNvbQ%3D%3D&token=WHATEVER

In this case you can also get a token from url as $_GET['token'] and check if it is the same as one in the file. If it is the same (and no one except you knows the algorithm with which token is created) - you can unsubscribe the user. In case of failure you can consider that someone is cheating)

Answer 2

You should worry when you only encode your parameters.

As you already expected gives Base64 no security, also the fact that you expect an Id and a email gives information to hack you.

The third risk is your response, there you als give information away, just inform your that the request is processed.

You should use encryption see to be safe.