🔒 Locked

PHP: sending POST data without forms

Started by Sander Nov 19, 2003 at 7:24 AM 3 replies 1.2k views

Original Post

Nov 19, 2003 at 7:24 AM

I've got a rather tricky question. I'm using PHP's GD extension to generate dynamic graphs for a website i'm designing. These graphs need to be shown in a regular page (not as a separate image). De data comes from a MySQL database and can be quite large. I know I can do this with source tags, so I just did somethin like:

echo "<img src='mygraph.php'>";

The problem: For security reasons, I don't want to give mygraph.php access to the database. That means I will need to send all the data that make up the graph via the URL to mygraph.php. Ofcourse, this doesn't work since the URL (with all the GET data) can be only 2060 or so characters long. I need to send it all as POST data. My current setup is like this: FILE: FORM.PHP This gets some user input about the data that needs to be displayed. It is send as POST data to RESULT.PHP FILE: RESULT.PHP This file reads the POST data and makes a database query out of it. It contains a lot of HTML code (nice menu's and stuff). Halfway through I now call the echo "<img src='mygraph.php'>"; code. I also need it to feed the mySQL result as POST data, but how????? FILE: MYGRAPH.PHP This should read the data send as POST data, make a graph with GD and then return the header('Content-type: image/png'); and the image data itself to the <img> tag from RESULT.PHP So.... How do I get the newly generated data as POST data from RESULT.PHP to MYGRAPH.PHP? Thanks for all the help you can offer! EDIT: I broke the forum tables... Oops.... Sander Maréchal [Lone Wolves Game Development][RoboBlast][Articles][GD Emporium][Webdesign][E-mail] [edited by - sander on November 19, 2003 10:15:39 AM]

abstractworlds

Nov 19, 2003 at 8:01 AM

How about using session variables?

1. In result.php assign the required data to a session variable

2. In mygraph.php access the session variable.

maniax

Nov 19, 2003 at 8:10 AM

I don''t see any reason (security, or other) to deny the image generator script access to database...
Anyway,... sending so much data thru POST isn''t secure at all, sending them thru session could cause problems in design of the application...

Maybe, it would be good to specify the reasons, which let you to make these security concerns.

m.

Sander

Nov 19, 2003 at 9:55 AM

The security reasons were mainly preventing people from calling the file from the URL and getting an image bacl as a download. Some of the graphs contain sensitive information and are restricted on a per-user basis. Problem was, the script that I include to connect to the DB also did an access privilidge check and a login check. That last one set a cookie before I send the Content-type: image/png header and the image would show up as a garbage string. Hardcoding de DB access into the mygraph script would give anyone access to the graph.

I''ve solved the problem now by ripping my connection/login script apart into 3 separate files so I can make a database connection AND check a users access settings without sending headers with the login check, so now I can grant the mygraphs script access to the database.

PS: saving the image to disk didn''t work for me as the server apparently doesn''t have any file writing rights in the htdocs folder (OpenBSD + Apache). I''d have to double-check that with the sysAdmin around here though but he''s gone till next monday...

Sander Maréchal
[Lone Wolves Game Development][RoboBlast][Articles][GD Emporium][Webdesign][E-mail]

Topic Locked

This topic has been locked by a moderator. New replies are not allowed.