Every story and comment from the Hacker News API, in a layout borrowed from 2001.
A comment on Abusing the PHP Query String Parser to Bypass IDS, IPS, and WAF.
In other words: check that the id is a string with digits only.
Don't search for invalid characters like ASCII NUL or for clever escapes, because there are too many ways of abuse.
Use ctype_digit() for numerical ids and stop with a validation error if ctype_digit() does not return TRUE.
https://www.php.net/manual/en/function.ctype-digit.php
For more complicated cases (like an id with lowercase letters and digits) preg_match() can be used, for example: preg_match('/^[a-z0-9]+$/').
There are no comments on this comment yet.
In other words: check that the id is a string with digits only.
Don't search for invalid characters like ASCII NUL or for clever escapes, because there are too many ways of abuse.
Use ctype_digit() for numerical ids and stop with a validation error if ctype_digit() does not return TRUE.
https://www.php.net/manual/en/function.ctype-digit.php
For more complicated cases (like an id with lowercase letters and digits) preg_match() can be used, for example: preg_match('/^[a-z0-9]+$/').