Security on a redirect page for a short URL service

Question

I'm setting up a simple short url service which utilises a template (code below) to forward the user to the correct page based on an entry id in the URL.

The following code is based on EllisLab's docs:

• Security Guidelines
• Database Class

Because the segment variable will be user-supplied, I want to make sure I haven't missed anything security-wise.

Is this sufficient security or are there additional/better methods I can employ?

(PHP is enabled on input)

   <?php

       $this->EE =& get_instance();
        $seg3 = $this->EE->uri->segment(3);
        $entry_id_clean = ee()->security->xss_clean($seg3);
        $entry_id = ee()->db->escape_str($entry_id_clean);
        $query = ee()->db->select('channel_id, url_title')
            ->from('exp_channel_titles')
            ->where(array(
                    'entry_id' => $entry_id,
            ))
            ->limit(1)
            ->get();

        $title = $query->row('url_title');
        $channel = $query->row('channel_id');

        // Redirect to the correct page...

    ?>

Answer 1

The only thing i see from a security standpoint is EllisLab considers php in template a bad practice. If this where me I would create a small plugin that would render your PHP for you. and pass the segment through a parameter. That would then redirect the user.

To create a plugin you can use my plugin starterkit.

1.) Create a folder with lowercase plugin name.

2.) Create file called pi.pluginname.php

3.) Paste the following code in that file.

<?php if ( ! defined('BASEPATH')) exit('No direct script access allowed');

/**
 * Pluginname Class

 * @package         ExpressionEngine
 * @category        Plugin
 * @author          Matthew Johnson
 * @copyright       Copyright (c) 2010, Jane Doe
 * @link            http://midwesterninteractive.com/
 */

$plugin_info = array(
    'pi_name'         => 'Pluginname',
    'pi_version'      => '1.0',
    'pi_author'       => 'Matthew Johnson',
    'pi_author_url'   => 'http://MidwesternInteractive.com/',
    'pi_description'  => 'Allows you to generate 1 of 13. ',
    'pi_usage'        => PluginName::usage()
);

class Pluginname
{

    public $return_data = "";

    // --------------------------------------------------------------------

    /**
     * Pluginname
     *
     * Plugin Description
     *
     * @access  public
     * @return  string
     */
    public function __construct()
    {
        $this->EE =& get_instance();   

        /* Your Code For you Plugin Here 
        --------------------------------
        $entry_idParam = ee()->TMPL->fetch_param('eid');
        --------------------------------
        */



    }

    // --------------------------------------------------------------------

    /**
     * Usage
     *
     * This function describes how the plugin is used.
     *
     * @access  public
     * @return  string
     */
    public static function usage()
    {
        ob_start();  ?>

        @mattsidjohn
        @buildmidwestern
        http://midwesterninteractive.com


    <?php
        $buffer = ob_get_contents();
        ob_end_clean();

        return $buffer;
    }
    // END
}
/* End of file pi.pluginname.php */

To use your plugin you will place this in your template {exp:pluginname eid="{segment_3"}

4.) Then place the plugin folder in the system > expressionengine > third_party folder

You can reference the plugin docs here: http://ellislab.com/expressionengine/user-guide/development/plugins.html