How to prevent user generated faults?

i am new to PHP so don't know how this would turn out. Lets say i have a开发者_StackOverflow add friend page. And in the database lets say i have a table called "friends" and the following rows: my_id and friend_id and id_request.

And now i have a php page that will look something like: addfriend.php?id=friendid

And then i use the id from that link to insert in to the database my id and that friendid.

The question is what will happen if someone enters "kdjfkldjlfk" in the link in the address bar?

you need to prevent those cases and validate

ex:

test that the $_GET['id'] isset and that the friendid is real , you could query the database to see that the id exists ...

If you mean "What will happen if someone visits the URI for an id that does not exist?", then it depends on what your PHP says should happen.

If your PHP doesn't check how many results it got from its SQL query, then it is quite possible that the page will spit out a 500 Internal Server Error.

If you've designed it properly, then it would return a document that explains that you cannot add a user that does not exist as a friend.

Actually, if you've designed it properly then the data should be sent via POST not GET since adding a friend is not an idempotent event. (See the HTTP specification — GET should be free of side effects)

You need to validate your user input. First, cast the $_GET value to an int type, and if it's equal to 0, tell them they've mistyped it.

$var = (int)$_GET['id'];

if($var == 0)
{
    // Error
}
else
{
    // The rest of your code
}

It turns out that PHP has some pretty cool filter functionality built-in. You should learn them and use them:

if (filter_var($_GET['id'], FILTER_VALIDATE_INT) === false) {
    // error
}

if (filter_var($_GET['email'], FILTER_VALIDATE_EMAIL) === false) {
    // error
}

if (filter_var($_GET['ip_address'], FILTER_VALIDATE_IP, FILTER_FLAG_IPV4) === false) {
    // error
}

http://us.php.net/manual/en/function.filter-var.php