I am using a main Site Engine class which is constructing most of my pages. I'm using this language function to change language website for all of my pages in the start of the Site Engine class:

`$defaultLang = 'en';

//Checking, if the $_GET["language"] has any value
//if the $_GET["language"] is not empty
if (!empty($_GET["language"])) { //<!-- see this line. checks 
    //Based on the lowecase $_GET['language'] value, we will decide,
    //what lanuage do we use
    switch (strtolower($_GET["language"])) {
        case "en":
            //If the string is en or EN
            $_SESSION['lang'] = 'en';
        case "tr":
            //If the string is tr or TR
            $_SESSION['lang'] = 'tr';
            //IN ALL OTHER CASES your default langauge code will set
            //Invalid languages
            $_SESSION['lang'] = $defaultLang;

//If there was no language initialized, (empty $_SESSION['lang']) then
if (empty($_SESSION["lang"])) {
    //Set default lang if there was no language
    $_SESSION["lang"] = $defaultLang;


I am asking two questions:

  1. Can somehow the domain.com/?language=LANG_HERE be exploited?

  2. Since I store additional session variables upon successful login into the website: $_SESSION['Account'], $_SESSION['Password'], $_SESSION['Email'] Is it possible the lang session variable to be exploited or manipulated? It's NOT user input since I'm setting it according to the response of ./?language=LANG_HERE but still overall can this script above be exploited somehow?

Sorry if these questions seems stupid but I am still learning and I need to know that for sure. Thank you!


Your code looks good and there doesn't appear to be anything you need to be worried about.

A side note or two:

I would consider adding trim() to your variable to clean any white space.

I am a little curious why you use if(!empty){}if(empty){} instead of an if(!empty){}else{}

  • Thanks for your comment. It's appreciated. So, the code is good and I should add trim() here: switch trim((strtolower($_GET["language"]))) { , right? Also, I used empty like that because I struggled a bit with checking if it's empty or not. Still it works. Let me know for the trim please. – Monk25 Oct 20 '14 at 16:49
  • Please let me know. – Monk25 Oct 20 '14 at 23:00
  • trim(strtolower($_GET["language"])) {} – David Houde Oct 20 '14 at 23:46
  • Is it actually required/better to include trim() on it and is there anything else major to be changed? – Monk25 Oct 21 '14 at 8:12
  • Actually it doesn't work after I added the trim(). It doesn't load the page at all. No error just white page only. – Monk25 Oct 21 '14 at 8:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.