Tips for using Query String info on website

I received an e-mail tongiht that was faked to look like a bank writing to confirm account info, with a link to a page on the banks site that allowed content to come from the URL's query string.

I will not go into details on how they did this as to not aid someone else from doing the same thing (I did a search and found 5 other banks with same hole, and contacted each one).

To protect yourself, anytime you have a script use info from the query string, make sure you have checking in there to prevent someone from changing the QS to be something else, especially if it were to allow your page to grab info from another server.

In a less dangerous example, consider something like "http://mysite.com/error.php?message=Invalid%20username" that you may use on your site to display a text message in the middle of your page layout. In this case the error.php file displays your full page layout, and places what is in message= on the page, this case displaying "Invalid User".

If you do no checking, someone could manually enter the following URL: http://mysite.com/error.php?message=%3Cimg%20src=%22http%3A%2F%2Fi.a.cnn...

This would have your page insert the code into the page, and in this case displaying CNN's logo.

Now, in this case using built in functions to strip HTML code would easily rip these out. However, keep in mind if you use a name of a webpage file in the URL, always check to make sure the file passed CANNOT be one that is a url to another site. Like I said, I found a 5 banks that didn't do this check, and allow someone to put their own content in the bank's template.

Always think SECURITY!

-Greg