0

I'm setting up a simple short url service which utilises a template (code below) to forward the user to the correct page based on an entry id in the URL.

The following code is based on EllisLab's docs:

Because the segment variable will be user-supplied, I want to make sure I haven't missed anything security-wise.

Is this sufficient security or are there additional/better methods I can employ?

(PHP is enabled on input)

   <?php

       $this->EE =& get_instance();
        $seg3 = $this->EE->uri->segment(3);
        $entry_id_clean = ee()->security->xss_clean($seg3);
        $entry_id = ee()->db->escape_str($entry_id_clean);
        $query = ee()->db->select('channel_id, url_title')
            ->from('exp_channel_titles')
            ->where(array(
                    'entry_id' => $entry_id,
            ))
            ->limit(1)
            ->get();

        $title = $query->row('url_title');
        $channel = $query->row('channel_id');

        // Redirect to the correct page...

    ?>
2
  • Just a heads up. Did you know there is a free add-on from Solspace for doing short urls and directing them wherever you want? devot-ee.com/add-ons/shortcut
    – foamcow
    Jul 8, 2014 at 10:49
  • Yep - I know, thanks though. Jul 8, 2014 at 22:02

1 Answer 1

2

The only thing i see from a security standpoint is EllisLab considers php in template a bad practice. If this where me I would create a small plugin that would render your PHP for you. and pass the segment through a parameter. That would then redirect the user.

To create a plugin you can use my plugin starterkit.

1.) Create a folder with lowercase plugin name.

2.) Create file called pi.pluginname.php

3.) Paste the following code in that file.

<?php if ( ! defined('BASEPATH')) exit('No direct script access allowed');

/**
 * Pluginname Class

 * @package         ExpressionEngine
 * @category        Plugin
 * @author          Matthew Johnson
 * @copyright       Copyright (c) 2010, Jane Doe
 * @link            http://midwesterninteractive.com/
 */

$plugin_info = array(
    'pi_name'         => 'Pluginname',
    'pi_version'      => '1.0',
    'pi_author'       => 'Matthew Johnson',
    'pi_author_url'   => 'http://MidwesternInteractive.com/',
    'pi_description'  => 'Allows you to generate 1 of 13. ',
    'pi_usage'        => PluginName::usage()
);

class Pluginname
{

    public $return_data = "";

    // --------------------------------------------------------------------

    /**
     * Pluginname
     *
     * Plugin Description
     *
     * @access  public
     * @return  string
     */
    public function __construct()
    {
        $this->EE =& get_instance();   

        /* Your Code For you Plugin Here 
        --------------------------------
        $entry_idParam = ee()->TMPL->fetch_param('eid');
        --------------------------------
        */



    }

    // --------------------------------------------------------------------

    /**
     * Usage
     *
     * This function describes how the plugin is used.
     *
     * @access  public
     * @return  string
     */
    public static function usage()
    {
        ob_start();  ?>

        @mattsidjohn
        @buildmidwestern
        http://midwesterninteractive.com


    <?php
        $buffer = ob_get_contents();
        ob_end_clean();

        return $buffer;
    }
    // END
}
/* End of file pi.pluginname.php */

To use your plugin you will place this in your template {exp:pluginname eid="{segment_3"}

4.) Then place the plugin folder in the system > expressionengine > third_party folder

You can reference the plugin docs here: http://ellislab.com/expressionengine/user-guide/development/plugins.html

2
  • No problem, if this was the answer to your question please mark as answered. Jul 8, 2014 at 5:14
  • Yes, will do. On a side note, I don't think Ellislab considers php in templates "bad practice" - it's a documented feature. The only bad practice is when it is used badly - and this is what they warn against. Jul 8, 2014 at 22:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.