URL parameters encoded to prevent site hacking 2

[crusader]

Can anyone advise how you encode an url appended id (for throught site recognition of user)

e.g.

first cfm file:

<a href=&quot;nextpage.cfm?id=#userid#&quot;>next page</a>
-------------------------------------------------------
then the url would look like this:

http://mysite.nextpage.cfm?id=9

how can I hide the number 9 so that no one can hack into mid site?

I can and am using session verification as well.

 

[katun]

Why not use Session or Client Variables, I think that would be a much better choice for this type of information.

Bill Guttman - katun@mindspring.com
Great Coldfusion tips at

http://www.katungroup.com/coldfusionlinks2.htm

 

[GunJack]

While I agree with Katun, the following code should do what you originally asked.

<cfset myHashValue=&quot;3kdc9e&quot;> <!--- arbitrary encrypt string --->
<a href=&quot;nextpage.cfm?id=#encrypt(userid,myHashValue)#&quot;>next page</a>

On nextPage.cfm, you'll need this:

<cfset myHashValue=&quot;3kdc9e&quot;>
<cfset id = decrypt(url.id,myHashValue)>

This doesn't prevent someone from hijacking a session since supplying the same url string will decrypt the same and still allow them access. The only way to really accomplish this is to create a unique &quot;hash&quot; value for each user and store it in a session variable. This way, the url string will only work for a specific user. Then again, if you're using session variables, I would just store the userID there in the first place as Katun suggests.

Good luck,
GJ

 

[katun]

Try this code. Put a value in a unique session variable for every link and pass a sequential id via a URL parameter and use that URL parameter on the next page to figure out what session variable to assign the hidden ID from.

Bill Guttman
Great Coldfusion Tips

http://www.katungroup.com/coldfusionlinks2.htm

Calling Page: page.htm
----------------------------------
<CFSET Session.id1 = 42>
<CFSET Session.id2 = 32>
<CFSET Session.id3 = 122>
<CFSET Session.id4 = 432>

<a href=&quot;link.htm?id=1&quot;>Link1</a>
<a href=&quot;link.htm?id=2&quot;>Link2</a>
<a href=&quot;link.htm?id=3&quot;>Link3</a>
<a href=&quot;link.htm?id=4&quot;>Link4</a>


Link Page Example: link.htm
----------------------------------
<CFIF url.id EQ 1>
<CFSET Variables.idNbr = Session.id1>
</CFIF>

<CFIF url.id EQ 2>
<CFSET Variables.idNbr = Session.id2>
</CFIF>