Don't be so hard on yourself, man.
The thing is, $_GET is being exploded any way, being legit or not. Then every array entry is being cleaned.
SESSION is just a special array. It responds and stores data like any ordinary array variable, with the difference of being stored on the server. If you still don't trust SESSIONS and think they may be hijacked/injected this way, you can check $_GET on the way. But it will slow down get_id for 20-30%, thus eliminating all SESSION-based get_id benefits.
Here's where one may want to check for XSS. But it's not nessesary.
$url = explode('/', $_GET['category']);
Final version (both functions):
// GET ID
// CleanGetSef MODDED, SESSION-based.
// Modded by Armen. Inspired by Ghassem Tofighi's get_id() booster.
function get_id($parameter) {
if ($_SESSION['last']['GET']!= $_GET){
unset ($_SESSION['last']);
$_SESSION['last']['GET'] = $_GET;
$url = array();
$url = explode('/', $_GET['category']);
$get_id = array();
$get_id['category'] = cleanGetSef($url['0']);
$_SESSION['last']['category'] = $get_id['category'];
if (isset($url['1'])) {
$sub_cat = cleanGetSef($url['1']);
$result = mysql_query("SELECT seftitle FROM ".db('prefix')."categories WHERE seftitle = '$sub_cat'");
if (!$result || !mysql_num_rows($result)) {
$subcat = NULL;
}
else {
$r = mysql_fetch_array($result); {$subcat = $r['seftitle'];
}
$get_id['subcategory'] = $subcat;
$_SESSION['last']['subcategory'] = $get_id['subcategory'];
}
if (isset($url['1']) && empty($subcat)) {
$get_id['article'] = cleanGetSef($url['1']);
$_SESSION['last']['article'] = $get_id['article'];
}
elseif (isset($url['2']) && !empty($subcat)) {
$get_id['article'] = cleanGetSef($url['2']);
$_SESSION['last']['article'] = $get_id['article'];
}
if (isset($url['2']) && empty($subcat)) {
$get_id['commentspage'] = cleanGetSef($url['2']);
$_SESSION['last']['commentspage'] = $get_id['commentspage'];
}
elseif (isset($url['3']) && !empty($subcat)) {
$get_id['commentspage'] = cleanGetSef($url['3']);
$_SESSION['last']['commentspage'] = $get_id['commentspage'];
}
}
}
else {
$get_id['subcategory'] = $_SESSION['last']['subcategory'];
$get_id['category'] = $_SESSION['last']['category'];
$get_id['article'] = $_SESSION['last']['article'];
$get_id['commentspage'] = $_SESSION['last']['commentspage'];
}
if (isset($get_id[$parameter])) {
return cleanGetSef($get_id[$parameter]);
}
}
// Codie's function for cleaning the SEF (OPTIMIZED)
function cleanGetSef($inSef) {
$sef = preg_match('/^[a-z0-9\-_#\.]+$/', $inSef) ? $inSef : NULL; return $sef;}
BTW, notice, what I've done to Codie's function:
// Codie's function for cleaning the SEF (OPTIMIZED)
function cleanGetSef($inSef) { $sef = preg_match('/^[a-z0-9\-_#\.]+$/', $inSef) ? $inSef : NULL; return $sef;}
Smaller, isn't it? Faster too. Let it be?
