is this safe/secure?

[Uranium-235]

I've been doing this for a while now. Basically, it prevents you having to put a first varible to determine how a script will execute. for instance, first I used

pictures.php?do=viewpictures&cat=[Id number]

Then I just switch-case do, and if somebody puts anything other then the pre-defined strings for $do, it will go to default: inside switch.

Now I do this:


$do = explode("&", $HTTP_SERVER_VARS["QUERY_STRING"]);
$do = $do[0];


so I don't have to have do=xxx at the top, now all I have to do is

pictures.php?viewpictures&cat=[id number]

Anybody know if this is a safe thing to do? can it be hacked? Still if anybody puts anything else then 'viewpictures' or another defined case it will still execute default: inside the switch

[Halide]

Is the sole purpose of this to reduce the length of the URL?

I would simply use ?action=foo&value=bar[etc...]

;)

[Uranium-235]

Naw it just looks better :)

[roninblade]

no matter how you do it, its still the same - every variable/value will still be shown in the url.

[Hawk]

As long as you aren't eval() (or something similar)'ing $do, you're fine. All they can do is change $do to any value which doesn't contain an ampersand, which they could do anyway.