SQL/URL Query

Itsdacraic

Hi,

I'm just wondering if it is possible to remove or mask SQL queries from appearing in my websites URLs?

e.g. http://www.joebloggs.ie/index.php?id=2&pg=/Accounts-Department.php becomes www.jobloggs.ie/index/Accounts-Department.php (or similar)

Is this a simple change a developer could make or would it require an overhaul of how the entire site is coded? (very broad question I know, but just wondering if it is possible).

thanks

A developer should be able to use mod_rewrite to repackage the urls as
www.jobloggs.ie/Accounts-Department/id/2 or similar, but I think you want to pull the id out of the url altogether?

The thing is the system needs to get that id to display the right data and if you are clicking on a link to get to the page, then the id will need to be in the url somewhere. You could encode the id to hide it from casual observers, but if the page is publicly accessible I don't see why you need to do that.

Maybe I misunderstood the question?

Itsdacraic

Deleted User wrote: »

A developer should be able to use mod_rewrite to repackage the urls as
www.jobloggs.ie/Accounts-Department/id/2 or similar, but I think you want to pull the id out of the url altogether?

The thing is the system needs to get that id to display the right data and if you are clicking on a link to get to the page, then the id will need to be in the url somewhere. You could encode the id to hide it from casual observers, but if the page is publicly accessible I don't see why you need to do that.

Maybe I misunderstood the question?

Thanks for the answer, it's almost purely for visual/vanity reasons.
The php urls just look very messy and i'm sure they do nothing to help the SEO of my website.

There's also the fact that I'm getting a lot of traffic from hackers, who are googling for SQL strings in the URL and then trying injection attacks.

sicruise

Stop saying SQL string, you are driving me mad Query String if you have to call it something

You could just put the ID in the session if it is a user ID, use mod_rewrite or use POST requests instead? I'm not sure what your system is like though.

matt-dublin

sicruise wrote: »

Stop saying SQL string, you are driving me mad Query String if you have to call it something

You could just put the ID in the session if it is a user ID, use mod_rewrite or use POST requests instead? I'm not sure what your system is like though.

if anything its just a URL string

query string is an asp reference no?

I hope you didn't pay your web designer for that site....
Anyone who allowed urls like that should be shot!

sicruise

http://en.wikipedia.org/wiki/Query_string