/    Sign up×
Community /Pin to ProfileBookmark

Email Link Shows Variable in Browser

Hi

I am using a mail() command to send an e-mail which contains a link to a PHP page with a ?variable. I am using an HTML header so that the email contains an <A> link which takes the user to the relevant page. The code looks like this:

[CODE]
$headers = “MIME-Version: 1.0rnContent-type: text/html;
charset=iso-8859-1rnFrom:”.$emailfrom.”rn”;
$mailmessage = $namefrom;
$mailmessage .= ‘ has sent you a picture! To see the
picture they have drawn for you please click on this link <a
href=”http://www.netcartoon.net/draw/drawer.php?
drawnum=’.$drawnum.'”>Your Pic</a>’;
$subject= $namefrom.” has sent you a picture”;

mail($emailto, $subject, $mailmessage, $headers);
[/CODE]

The problem is, the variable shows up in the browser when the user clicks the link, like this

[url]http://www.website.com/page.php?variable=123[/url]

Since this is for messages people can send each other, that’s not very cool, because someone could easily adjust the variable and read other people’s messages.

Is there a way I can hide the variable which is passed in when the user clicks on the link? What would I need to change in my code?

Thanks.

to post a comment
PHP

4 Comments(s)

Copy linkTweet thisAlerts:
@DaiWelshSep 09.2003 — Assuming that the site does not require login so you can't protect the items that way your best bet would be to create a random unique id string (perhaps using a hash algorithm) , store that with the drawing and use it on the email link

e.g.

http://www.website.com/page.php?variable=x7Ty56HPX3A

that way one user cannot (easily) guess what string would be used for a different user's messages.

HTH,

Dai
Copy linkTweet thisAlerts:
@tobyw_1969authorSep 09.2003 — Thanks DaiWelsh ?

If there's no way of actually hiding it, that would work for me so thanks for the idea. The only problem is, I don't actually know what an algorithm is really (blush) or how I could go about making one to generate a unique id. Do you know any links which might help me? Is it quite straightforward?

Thanks a lot.
Copy linkTweet thisAlerts:
@DaiWelshSep 09.2003 — The only way to 'semi' hide it would be to create an HTML format mail rather than plain text and use a form to submit to the website rather than a link. However this does not hide the id from anyone vaguely technical as they can just view the source of the message.

An algorithm is just a fancy way of saying a formula or set of rules for performing a task. You could create a unique id just by looping ten times and selecting a random letter each time. Stick the ten letters together and you have a simple id string. The advantage of using an existing algorithm might be that it generates a guaranteed unique id (otherwise you might need to check you have not already used the id before to avoid duplicates).

A quick google for "PHP random unique ID" got some useful results e.g.

[URL=http://www.phpfreaks.com/quickcode/code/91.php]http://www.phpfreaks.com/quickcode/code/91.php[/URL]

which uses a uniqid function.

HTH,

Dai
Copy linkTweet thisAlerts:
@tobyw_1969authorSep 09.2003 — That's great - thanks. I am using HTML for the email, so I will have a go at trying it that way. I'm not sure how but I will have fun trying! If not, I will use the uniqie id method. Thanks for that link - looks really useful for lots of stuff! ?
×

Success!

Help @tobyw_1969 spread the word by sharing this article on Twitter...

Tweet This
Sign in
Forgot password?
Sign in with TwitchSign in with GithubCreate Account
about: ({
version: 0.1.9 BETA 6.2,
whats_new: community page,
up_next: more Davinci•003 tasks,
coming_soon: events calendar,
social: @webDeveloperHQ
});

legal: ({
terms: of use,
privacy: policy
});
changelog: (
version: 0.1.9,
notes: added community page

version: 0.1.8,
notes: added Davinci•003

version: 0.1.7,
notes: upvote answers to bounties

version: 0.1.6,
notes: article editor refresh
)...
recent_tips: (
tipper: @meenaratha,
tipped: article
amount: 1000 SATS,

tipper: @meenaratha,
tipped: article
amount: 1000 SATS,

tipper: @AriseFacilitySolutions09,
tipped: article
amount: 1000 SATS,
)...