How do i make $_GET more secure.?

cybermam

New Member
I am using the get method to perform some operation like, approve, markasspam, delete, for commenting system. i know it is highly insecure to go this way but i cannot help it out. because the reason for using $_GET method is to perform the operation within the page itself using PHP_SELF, and FYI i am using the post method using checkbox to perform the operation too. now for making it bit secure i want to randomize the number or generate the hash or something and then compare it, get the id and perform the operationmy current code is somewhat like this.\[code\]<?php if($approve == 1 ) { ?> <a href="http://stackoverflow.com/questions/3682480/<?php echo $_SERVER['PHP_SELF']."?approve=".$id; ?>">Unapprove</a> <?php } else { ?> <a href="http://stackoverflow.com/questions/3682480/<?php echo $_SERVER['PHP_SELF']."?unapprove=".$id; ?>">Approve</a> <?php }?> | <a href="http://stackoverflow.com/questions/3682480/<?php echo $_SERVER['PHP_SELF']."?spam=".$id; ?>">Spam</a> | <a class="edit-comments" href="http://stackoverflow.com/questions/3682480/edit-comments.php?id=<?php echo $id; ?>">Edit</a> | <a href="http://stackoverflow.com/questions/3682480/<?php echo $_SERVER['PHP_SELF']."?delete=".$id; ?>">Delete</a>\[/code\]and i perform the operation using this code..\[code\]if(isset($_GET['approve'])) { $id = intval($_GET['approve']); $query = "UPDATE comments SET approve = '0' WHERE id = '$id'"; $result = mysql_query($query);}if(isset($_GET['unapprove'])) { $id = intval($_GET['unapprove']); $query = "UPDATE comments SET approve = '1' WHERE id = '$id'"; $result = mysql_query($query);}if(isset($_GET['delete'])) { $id = intval($_GET['delete']); $query = "DELETE FROM comments WHERE id = '$id'"; $result = mysql_query($query);}if(isset($_GET['spam'])) { $id = intval($_GET['spam']); $query = "UPDATE comments SET spam = '1' WHERE id = '$id'"; $result = mysql_query($query);}\[/code\]instead of using approve or unapprove or delete or spam, i want to randomize or hash that words and want it as lengthy as possible and then perform the operation. how do i do it? what is your take on this?\[quote\] EDIT: Please Note Only the Authenticated User i.e Admin will be able to perform this operation. even though it pass through authentication system i want to add more security even for admin. to avoid experiments or accident\[/quote\]the code is not exact it is just the sample to make you understand what i want to achieve.
 
Back
Top