To view a single article we're passing in the idea in the query string.
We then retrieve this value using the get array and pass this directly into the ESC you l to see what's
happening.
Let's add a line to print out the full Eskew L statement and then in the browser if we view an article
this is the select statement with the idae coming from the query string.
However as this appears in the address bar of the browser there's nothing to stop someone from changing
this for example to another number which isn't found as expected.
But you could put anything in here from some simple text which could even include some ESC You L..
This is called Eskew well injection.
We've allowed a user of the website to run some esky well on our server.
We'll look at this in more detail later on.
And it's an important security issue to be aware of.
Now we're not too vulnerable in this case.
As the my Escuela query method restricts the number of Escuela statements to one later on.
We'll see how Escuela injection can really cause problems and how to avoid it.
For now we can make this safer simply by checking that the ideas coming from the query string is a number
we can do this with.
Is numeric function.
So before we insert the value into the ESC You L..
Let's check its numeric
and if it isn't.
Simply set the article variable to No.
Now if we change the idea to a string
we get the message saying article not found and we dont get the Eskew L printed out as that's inside
the f block.
This also works if we remove the value altogether.
But not if we remove the query string variable all together.
Now we get an error saying undefined index.
This is because were trying to access an array element with the index idea and such an arrangement doesn't
exist in this get array.
Now we don't use this page without passing in an I.D. but someone could remove the query string.
Like I just did.
And doing this they would get a detailed error message like this.
It's good practice to avoid displaying detailed error messages.
Once your website is in production on a life server as information like this can give an attacker details
about your site that they could potentially exploit.
So to fix this before we check if the value is numeric.
First let's check that it's set.
We can do this using the IS SET function which returns have built in value based on whether a variable
is set on UT and will check this in the same if statement as were checking that the value is numeric.
Combining the two using the logical and operator there are two logical operators we could use for this
and and to ampersands.
I prefer to use the latter as it's more common.
So before we check that the value is numeric.
Let's first check that the value is set like that.
Then in the browser we can still see an article.
If the idea is a valid number but if we change it to a string we just get the article not found message.
And likewise if we remove the query string all together we no longer see the error message will look
at error handling in more detail later on.
Finally we'll just remove the line that we added earlier that prints out the esky well so that when
we view an article we no longer see the ESC u l string.