I'm setting up a simple short url service which utilises a template (code below) to forward the user to the correct page based on an entry id in the URL.

The following code is based on EllisLab's docs:

Because the segment variable will be user-supplied, I want to make sure I haven't missed anything security-wise.

Is this sufficient security or are there additional/better methods I can employ?

(PHP is enabled on input)


       $this->EE =& get_instance();
        $seg3 = $this->EE->uri->segment(3);
        $entry_id_clean = ee()->security->xss_clean($seg3);
        $entry_id = ee()->db->escape_str($entry_id_clean);
        $query = ee()->db->select('channel_id, url_title')
                    'entry_id' => $entry_id,

        $title = $query->row('url_title');
        $channel = $query->row('channel_id');

        // Redirect to the correct page...

  • Just a heads up. Did you know there is a free add-on from Solspace for doing short urls and directing them wherever you want? devot-ee.com/add-ons/shortcut – foamcow Jul 8 '14 at 10:49
  • Yep - I know, thanks though. – Adam George Jul 8 '14 at 22:02

The only thing i see from a security standpoint is EllisLab considers php in template a bad practice. If this where me I would create a small plugin that would render your PHP for you. and pass the segment through a parameter. That would then redirect the user.

To create a plugin you can use my plugin starterkit.

1.) Create a folder with lowercase plugin name.

2.) Create file called pi.pluginname.php

3.) Paste the following code in that file.

<?php if ( ! defined('BASEPATH')) exit('No direct script access allowed');

 * Pluginname Class

 * @package         ExpressionEngine
 * @category        Plugin
 * @author          Matthew Johnson
 * @copyright       Copyright (c) 2010, Jane Doe
 * @link            http://midwesterninteractive.com/

$plugin_info = array(
    'pi_name'         => 'Pluginname',
    'pi_version'      => '1.0',
    'pi_author'       => 'Matthew Johnson',
    'pi_author_url'   => 'http://MidwesternInteractive.com/',
    'pi_description'  => 'Allows you to generate 1 of 13. ',
    'pi_usage'        => PluginName::usage()

class Pluginname

    public $return_data = "";

    // --------------------------------------------------------------------

     * Pluginname
     * Plugin Description
     * @access  public
     * @return  string
    public function __construct()
        $this->EE =& get_instance();   

        /* Your Code For you Plugin Here 
        $entry_idParam = ee()->TMPL->fetch_param('eid');


    // --------------------------------------------------------------------

     * Usage
     * This function describes how the plugin is used.
     * @access  public
     * @return  string
    public static function usage()
        ob_start();  ?>


        $buffer = ob_get_contents();

        return $buffer;
    // END
/* End of file pi.pluginname.php */

To use your plugin you will place this in your template {exp:pluginname eid="{segment_3"}

4.) Then place the plugin folder in the system > expressionengine > third_party folder

You can reference the plugin docs here: http://ellislab.com/expressionengine/user-guide/development/plugins.html

| improve this answer | |
  • No problem, if this was the answer to your question please mark as answered. – mattsidjohn Jul 8 '14 at 5:14
  • Yes, will do. On a side note, I don't think Ellislab considers php in templates "bad practice" - it's a documented feature. The only bad practice is when it is used badly - and this is what they warn against. – Adam George Jul 8 '14 at 22:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.