Does the use of mod_rewrite
make PHP array injection (web parameter key tampering) impossible when the keys are unknown (and hard to guess)?
Let's say we have the following URL:
https://example.com/product.php?id=1&action=show
example.com decided to rewrite there URLs to a prettier version like:
https://example.com/product/1
Therefor they use the following RewriteRule
:
RewriteRule ^/product/(.*)$ /product.php?id=$1&action=show [L]
Now the keys are id
and action
and those values are 1
and show
. I understand the values will be rewrited, no protection is involved anyhow. Injections are still possible and so on. But the keys cannot be changed assuming they are unknown. In this example I used the guessable keys id
and action
but they could as well be two completely long and random keys.
Now my question is about the keys. I could inject one or multiple []
in the parameter to make that the value of that id
an PHP array instead of string. Like this:
https://example.com/product.php?id[]=1&action=show
For a rewrited URL their is no way to do so unless you know the key. Am I right? In this example the following will still be possible because they key is easy to guess. The below example the URL will know have the key id
two times and use the last one with the injected []
.
https://example.com/product/1?id[]=1
But assuming the keys were not known and easy to guess. Let's say:
RewriteRule ^/product/(.*)$ /product.php?7b8d164d7820713ef5be524d2bde7828999c78d6=$1&28c4abba80b7a2038328e54a81f51367ead9172a=show [L]
I suppose that then there is no way to inject []
without knowing the keys.
Additionally, when you check the current URL in your PHP script for the characters ?
and &
you can prevent bypasses like https://example.com/product/1?id[]=1
. In my opinion then array injection or altering the key is not possible anymore just the value can be changed. Right?