blocks|key|274001|text|隐藏数字是一个糟糕的解决方案，更好的方法是通过http://php.net/manual/en/function.mcrypt-encrypt.php加密这个数字|type|unstyled|depth|inlineStyleRanges|entityRanges|offset|length|data|274002|当然，您可以忽略将这个$_GET‘’var‘转换为char数组的字母，然后使用range，例如|274003|$_GET['var']+=+123543123;|code-block|syntax|javascript|274004|要获得543，您需要使用函数substr()|style|CODE|274005|$hidden_number+=+substr($_GET['var'],3,3);|274006|entityMap|0|LINK|mutability|MUTABLE|url|http://php.net/manual/en/function.mcrypt-encrypt.php^0|N|1G|0|0|0|0|E|8|0|0^^$0|@$1|2|3|4|5|6|7|Y|8|@]|9|@$A|Z|B|10|1|11]]|C|$]]|$1|D|3|E|5|6|7|12|8|@]|9|@]|C|$]]|$1|F|3|G|5|H|7|13|8|@]|9|@]|C|$I|J]]|$1|K|3|L|5|6|7|14|8|@$A|15|B|16|M|N]]|9|@]|C|$]]|$1|O|3|P|5|H|7|17|8|@]|9|@]|C|$I|J]]|$1|Q|3|-4|5|6|7|18|8|@]|9|@]|C|$]]]|R|$S|$5|T|U|V|C|$W|X]]]]

Hiding number is poor solution, the better one is to encrypt this number via <a href="http://php.net/manual/en/function.mcrypt-encrypt.php" rel="nofollow">http://php.net/manual/en/function.mcrypt-encrypt.php</a>

of course you can ignore letters cast this $_GET['var'] to char array and then use range for example

<pre><code>$_GET['var'] = 123543123;
</code></pre>

to get 543 you need to use function <code>substr()</code>:

<pre><code>$hidden_number = substr($_GET['var'],3,3);
</code></pre>

blocks|key|1181663|text|查看手册中的substr方法：http://php.net/substr|type|unstyled|depth|inlineStyleRanges|entityRanges|offset|length|data|1181664|就像这样|1181665|$id+=+substr($_GET['ID'],4,-4);+|code-block|syntax|javascript|1181666|应该做你想要的把戏|1181667|entityMap|0|LINK|mutability|MUTABLE|url|http://php.net/substr^0|F|L|0|0|0|0|0^^$0|@$1|2|3|4|5|6|7|U|8|@]|9|@$A|V|B|W|1|X]]|C|$]]|$1|D|3|E|5|6|7|Y|8|@]|9|@]|C|$]]|$1|F|3|G|5|H|7|Z|8|@]|9|@]|C|$I|J]]|$1|K|3|L|5|6|7|10|8|@]|9|@]|C|$]]|$1|M|3|-4|5|6|7|11|8|@]|9|@]|C|$]]]|N|$O|$5|P|Q|R|C|$S|T]]]]

check the manual for substr method: <a href="http://php.net/substr" rel="nofollow">http://php.net/substr</a>

something like

<pre><code>$id = substr($_GET['ID'],4,-4); 
</code></pre>

should do the trick you want

blocks|key|3307331|text|您可以使用|type|unstyled|depth|inlineStyleRanges|entityRanges|data|3307332|preg_match('/%5E\d{4}(\d{4})/',+$_GET['id'])|code-block|syntax|javascript|3307333|entityMap^0|0|0^^$0|@$1|2|3|4|5|6|7|I|8|@]|9|@]|A|$]]|$1|B|3|C|5|D|7|J|8|@]|9|@]|A|$E|F]]|$1|G|3|-4|5|6|7|K|8|@]|9|@]|A|$]]]|H|$]]

You can use 

<pre><code>preg_match('/^\d{4}(\d{4})/', $_GET['id'])
</code></pre>

blocks|key|1181705|text|您可以使用substr()函数从字符串中删除前4个和后4个字符。但更好的是，只需使用内置的php加密函数对您的id进行加密|type|unstyled|depth|inlineStyleRanges|entityRanges|data|1181706|entityMap^0|0^^$0|@$1|2|3|4|5|6|7|D|8|@]|9|@]|A|$]]|$1|B|3|-4|5|6|7|E|8|@]|9|@]|A|$]]]|C|$]]

You can use substr() function to remove the first 4 and last 4 characters from your string. 
But better yet, just encde your id using build-in php encryption function

blocks|key|274033|text|$ID+=+substr($_GET['ID'],+3,+-4);|type|code-block|depth|inlineStyleRanges|entityRanges|data|syntax|javascript|274034|http://www.php.net/manual/en/function.substr.php|unstyled|offset|length|274035|entityMap|0|LINK|mutability|MUTABLE|url^0|0|0|1C|0|0^^$0|@$1|2|3|4|5|6|7|P|8|@]|9|@]|A|$B|C]]|$1|D|3|E|5|F|7|Q|8|@]|9|@$G|R|H|S|1|T]]|A|$]]|$1|I|3|-4|5|F|7|U|8|@]|9|@]|A|$]]]|J|$K|$5|L|M|N|A|$O|E]]]]

<pre><code>$ID = substr($_GET['ID'], 3, -4);
</code></pre>

<a href="http://www.php.net/manual/en/function.substr.php" rel="nofollow">http://www.php.net/manual/en/function.substr.php</a>

blocks|key|1181716|text|在PHP中使用encrypt和decrypt函数。不要相信你自己的算法。否则，您可以在php中使用substr()。|type|unstyled|depth|inlineStyleRanges|offset|length|style|CODE|entityRanges|data|1181717|entityMap^0|7|7|F|7|0^^$0|@$1|2|3|4|5|6|7|H|8|@$9|I|A|J|B|C]|$9|K|A|L|B|C]]|D|@]|E|$]]|$1|F|3|-4|5|6|7|M|8|@]|D|@]|E|$]]]|G|$]]

Use <code>encrypt</code> and <code>decrypt</code> functions in PHP. Do not believe in your own algorithms. Otherwise you can use substr() in php.

blocks|key|273104|text|这将会起作用|type|unstyled|depth|inlineStyleRanges|entityRanges|data|273105|$id='1234554321';
preg_match('/\d{4}(\d%2B)\d{4}/',+$id,+$matches);
var_dump($matches[1]);|code-block|syntax|javascript|273106|但是..。|273107|我是不会做那种事儿的。|273108|我会生成一些唯一的字符串，将其存储在数据库中，并提供给最终用户。所以url应该是这样|273109|example.com/view.php?token=<unique-string>|273110|请参阅http://php.net/manual/en/function.uniqid.php以获取唯一字符串。|offset|length|273111|entityMap|0|LINK|mutability|MUTABLE|url|http://php.net/manual/en/function.uniqid.php^0|0|0|0|0|0|0|3|18|0|0^^$0|@$1|2|3|4|5|6|7|10|8|@]|9|@]|A|$]]|$1|B|3|C|5|D|7|11|8|@]|9|@]|A|$E|F]]|$1|G|3|H|5|6|7|12|8|@]|9|@]|A|$]]|$1|I|3|J|5|6|7|13|8|@]|9|@]|A|$]]|$1|K|3|L|5|6|7|14|8|@]|9|@]|A|$]]|$1|M|3|N|5|D|7|15|8|@]|9|@]|A|$E|F]]|$1|O|3|P|5|6|7|16|8|@]|9|@$Q|17|R|18|1|19]]|A|$]]|$1|S|3|-4|5|6|7|1A|8|@]|9|@]|A|$]]]|T|$U|$5|V|W|X|A|$Y|Z]]]]

this will work

<pre><code>$id='1234554321';
preg_match('/\d{4}(\d+)\d{4}/', $id, $matches);
var_dump($matches[1]);
</code></pre>

But..

I wouldn't do that.

I would generate some unique string, store it database and provide it to end user. So that url would be lilke this

<pre><code>example.com/view.php?token=&lt;unique-string&gt;
</code></pre>

see <a href="http://php.net/manual/en/function.uniqid.php" rel="nofollow">http://php.net/manual/en/function.uniqid.php</a> to get unique string.

blocks|key|3307457|text|您可以在PHP中使用substr()来提取所需的ID。|type|unstyled|depth|inlineStyleRanges|offset|length|style|CODE|entityRanges|data|3307458|像这样的东西？|3307459|<?php+echo+substr($_GET['ID'],+4,+-4);+?>|code-block|syntax|javascript|3307460|但是，出于“安全”的原因，这是一个可怕的想法。|3307461|你最好使用一个不是递增的ID，因此是“可猜测的”。尝试使用md5()函数或其他方法生成一个额外的ID，以及要存储在数据库中的主键。|3307462|http://php.net/manual/en/function.md5.php|3307463|entityMap|0|LINK|mutability|MUTABLE|url^0|A|8|0|0|0|0|T|5|0|0|15|0|0^^$0|@$1|2|3|4|5|6|7|Z|8|@$9|10|A|11|B|C]]|D|@]|E|$]]|$1|F|3|G|5|6|7|12|8|@]|D|@]|E|$]]|$1|H|3|I|5|J|7|13|8|@]|D|@]|E|$K|L]]|$1|M|3|N|5|6|7|14|8|@]|D|@]|E|$]]|$1|O|3|P|5|6|7|15|8|@$9|16|A|17|B|C]]|D|@]|E|$]]|$1|Q|3|R|5|6|7|18|8|@]|D|@$9|19|A|1A|1|1B]]|E|$]]|$1|S|3|-4|5|6|7|1C|8|@]|D|@]|E|$]]]|T|$U|$5|V|W|X|E|$Y|R]]]]

You could use <code>substr()</code> in PHP to extract the ID you need.

Something like this?

<pre><code>&lt;?php echo substr($_GET['ID'], 4, -4); ?&gt;
</code></pre>

BUT, this is a horrible horrible idea for 'security' reasons.

You would be better off using an ID that isn't incremental and therefore 'guessable'. Try using a <code>md5()</code> function or something to generate an additional ID, as well as your primary key to store in the database.

<a href="http://php.net/manual/en/function.md5.php" rel="nofollow">http://php.net/manual/en/function.md5.php</a>

blocks|key|1416846|text|$id=+substr($_GET['ID'],+4,+-4);|type|code-block|depth|inlineStyleRanges|entityRanges|data|syntax|javascript|1416847|unstyled|entityMap^0|0^^$0|@$1|2|3|4|5|6|7|G|8|@]|9|@]|A|$B|C]]|$1|D|3|-4|5|E|7|H|8|@]|9|@]|A|$]]]|F|$]]

<pre><code>$id= substr($_GET['ID'], 4, -4);
</code></pre>

blocks|key|1414305|text|您可以在服务器上使用一个包含两列的映射表，而不是尝试隐藏id+:+primary(hash)，id|type|unstyled|depth|inlineStyleRanges|entityRanges|data|1414306|哈希可以是一个随机的blob，但是为了可读性，你也可以使用一个uuid，例如|offset|length|1414307|hash+++++++++++++++++++++++++++++++++%7C+id
-------------------------------------%2B----
9d76d130-0119-4d7a-9eed-95ad3617e512+%7C+123|code-block|syntax|javascript|1414308|然后，在url中使用散列。随机散列的优点是，除了服务器端表之外，散列和id之间没有相关性。|1414309|可以通过使用uniqid()和md5()或sha1()获得较小的散列|style|CODE|1414310|sha1(uniqid('',+true));|1414311|替代|BOLD|1414312|如果ID本身是公共的，但您只是想避免篡改，请查看hash_hmac()|1414313|$salt+=+md5(uniqid('',+true));
$signature+=+hash_hmac('sha1',+$id+.+$salt,+'some+super+secret+key');|1414314|使用类似于base64_encode(openssl_random_pseudo_bytes(8))的方法生成密钥|1414315|您也可以将此$signature和$salt添加到URL中，然后在收到它时进行验证。|1414316|$id+=+$_GET['id'];
$salt+=+$_GET['salt'];

if+(hash_hmac('sha1',+$id+.+$salt,+'some+super+secret+key')+===+$_GET['signature'])+{
++++//+valid
}|1414317|entityMap|0|LINK|mutability|MUTABLE|url|https://stackoverflow.com/questions/2040240/php-function-to-generate-v4-uuid/15875555#15875555^0|0|V|4|0|0|0|0|6|8|F|5|L|6|0|0|0|2|0|O|B|0|0|5|19|0|6|A|H|5|0|0^^$0|@$1|2|3|4|5|6|7|1D|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|1E|8|@]|9|@$D|1F|E|1G|1|1H]]|A|$]]|$1|F|3|G|5|H|7|1I|8|@]|9|@]|A|$I|J]]|$1|K|3|L|5|6|7|1J|8|@]|9|@]|A|$]]|$1|M|3|N|5|6|7|1K|8|@$D|1L|E|1M|O|P]|$D|1N|E|1O|O|P]|$D|1P|E|1Q|O|P]]|9|@]|A|$]]|$1|Q|3|R|5|H|7|1R|8|@]|9|@]|A|$I|J]]|$1|S|3|T|5|6|7|1S|8|@$D|1T|E|1U|O|U]]|9|@]|A|$]]|$1|V|3|W|5|6|7|1V|8|@$D|1W|E|1X|O|P]]|9|@]|A|$]]|$1|X|3|Y|5|H|7|1Y|8|@]|9|@]|A|$I|J]]|$1|Z|3|10|5|6|7|1Z|8|@$D|20|E|21|O|P]]|9|@]|A|$]]|$1|11|3|12|5|6|7|22|8|@$D|23|E|24|O|P]|$D|25|E|26|O|P]]|9|@]|A|$]]|$1|13|3|14|5|H|7|27|8|@]|9|@]|A|$I|J]]|$1|15|3|-4|5|6|7|28|8|@]|9|@]|A|$]]]|16|$17|$5|18|19|1A|A|$1B|1C]]]]

Instead of trying to hide the id, you could use a mapping table on the server with two columns: primary(hash), id

The hash can be a random blob, but for readability you could use a <a href="https://stackoverflow.com/questions/2040240/php-function-to-generate-v4-uuid/15875555#15875555">uuid</a> as well, e.g.

<pre><code>hash | id
-------------------------------------+----
9d76d130-0119-4d7a-9eed-95ad3617e512 | 123
</code></pre>

Then, use the hash inside the url. The advantage of a random hash is that there's no correlation between the hash and the id, other than the server-side table.

A smaller hash could be obtained by using <code>uniqid()</code> and <code>md5()</code> or <code>sha1()</code>:

<pre><code>sha1(uniqid('', true));
</code></pre>

Alternative

If the ID itself is public but you just want to avoid tampering, look into <code>hash_hmac()</code>:

<pre><code>$salt = md5(uniqid('', true));
$signature = hash_hmac('sha1', $id . $salt, 'some super secret key');
</code></pre>

Generate the key using something like <code>base64_encode(openssl_random_pseudo_bytes(8))</code>

You can add this <code>$signature</code> and <code>$salt</code> to the URL as well and then verify it when you receive it.

<pre><code>$id = $_GET['id'];
$salt = $_GET['salt'];

if (hash_hmac('sha1', $id . $salt, 'some super secret key') === $_GET['signature']) {
 // valid
}
</code></pre>

blocks|key|274070|text|您的subscriptionsedit.php脚本应接受客户ID并查找|type|unstyled|depth|inlineStyleRanges|entityRanges|data|274071|$_SESSION“密码”|274072|由用户在登录过程中预先设置，如下所示：|274073|subscriptionsedit.php?page=1&ID=77

look+at+password+stored+in+the+$_SESSION["PASSWORD"]+field+|code-block|syntax|javascript|274074|这样做就不可能偷偷进入其他客户的数据，因为$_SESSION[]是服务器为每个用户保存的私有信息|274075|entityMap^0|0|0|0|0|0^^$0|@$1|2|3|4|5|6|7|O|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|P|8|@]|9|@]|A|$]]|$1|D|3|E|5|6|7|Q|8|@]|9|@]|A|$]]|$1|F|3|G|5|H|7|R|8|@]|9|@]|A|$I|J]]|$1|K|3|L|5|6|7|S|8|@]|9|@]|A|$]]|$1|M|3|-4|5|6|7|T|8|@]|9|@]|A|$]]]|N|$]]

your subscriptionsedit.php script should accept the customer ID and look for

$_SESSION["PASSWORD"]

previously set by the user as a result of the login process, something like:

<pre><code>subscriptionsedit.php?page=1&amp;ID=77

look at password stored in the $_SESSION["PASSWORD"] field 
</code></pre>

doing that way it will not be possible to sneak inside the data of other customers because $_SESSION[] is private information held by the server for every user

I am currently using a programm to send newsletters, in every newsletter I am sending a link so the customer can look at his own data and sub/unsub from newsletters. The link I am using now is this: <code>http://localhost/Mail/subscriptionseditklant.php?ID=77</code> and is made with this code:

<pre><code>&lt;a href="subscriptionsedit.php?page=1&amp;ID=&lt;?=$objResult["ID"];?&gt;"&gt;subscriptions&lt;/a&gt;
</code></pre>

For security reasons I dont want to show the customer <code>ID=77</code> part so he can't modify it to look at other customers info. My idea was to hide the ID inside random numbers (4 in front and 4 behind the ID) which I have done using this:

<pre><code>&lt;a href="subscriptionsedit.php?page=1&amp;ID=&lt;? echo rand(1000,9999); ?&gt;&lt;?=$objResult["ID"];?&gt;&lt;? echo rand(1000,9999); ?&gt;"&gt;subscriptions&lt;/a&gt;
</code></pre>

This will display a link like this one: <code>http://localhost/Mail/subscriptionsedit.php?page=1&amp;ID=9755774430</code>

On the subscriptionsedit.php I am using <code>$_GET</code> to get the ID from the url.

My question: 
Is there any way I can get <code>$_GET</code> to ignore the first 4 and last 4 numbers from the ID so it will capture the right ID? 

I have tried to google for something like this but since I dont know how it is called (if it even exists) I was not able to find anything. I hope my question is clear but if you have any question just ask them! (Also if anyone knows a better title for this question feel free to edit it because I have no idea how to name this question)

PHP, Get $_GET to ignore numbers from url

翻译质量差，导致语言生硬或混乱。

没有提供实际的解决方法或示例。

解答不清晰，无法理解或解决问题。

页面排版不美观，阅读体验差。

文章

问答

视频

学习中心

腾讯云实验室

直播

竞赛

腾讯云代码分析专区

腾讯iOA零信任安全管理系统专区

腾讯云架构师技术同盟交流圈

腾讯云数据库专区

腾讯云顾问专区

腾讯云原生专区

腾讯混元专区

腾讯云TCE专区

腾讯云Lighthouse专区

腾讯云HAI专区

腾讯云Edgeone专区

腾讯云存储专区

腾讯云智能专区

腾讯轻联专区 

腾讯云开发专区

TAPD专区

腾讯轻量云游戏服专区

腾讯云最具价值专家

腾讯云架构师技术同盟

腾讯云创作之星

腾讯云开发者先锋

腾讯云代码助手

云原生构建

TAPD 敏捷项目管理

Cloud Studio

SDK中心

API中心

命令行工具

涵盖代码开发、场景应用、自动测试全流程，助你从零构建专属AI助手

一站式MCP教程库，解锁AI应用新玩法

我目前正在使用一个程序来发送时事通讯，在每个时事通讯中，我都会发送一个链接，这样客户就可以从时事通讯中查看自己的数据和sub/unsub。我现在使用的链接是这样的：http://localhost/Mail/subscriptionseditklant.php?ID=77，由下面的代码组成：<a href="subsc...

问PHP，让$_GET忽略url中的数字
EN

Stack Overflow用户

社区

活动

圈层

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问PHP，让$_GET忽略url中的数字EN