使用GET var保护PHP页面

I have a page that I want to execute via cron. It just does some pretty simple archiving stuff, nothing super high-security, no DB access etc.

Is it a secure practice to simply require a GET var to be present in order to execute the page? So myarchiver.php would be something like:

<?php

$mysecret_word = "abc123";

if ($_GET['secret'] == $mysecret_word){
    // execute my stuff here
}

Then you'd just call myarchiver.php?secret=abc123 in the crontab and the process would run, while any wrong answer or attempt to execute the page with no secret would simply present a blank page (with no extra server load).

I realize this is not "secure" against man in the middle attacks and if the site was compromised-- but I believe in general it's plenty secure to keep this script from being fired by random script kiddies and other idiots who may somehow know about its existence? The thing I'm guarding against is random malicious users who may know about this script bombarding it with requests in order to dos/tie up resources.

EDIT TO ADD: the server is not accessible via SSH and the cron is being executed on a remote machine-- so it must be done via an http request.

Thanks for input.

First off, why not just check the IP address of the server making the request?

If it has to be done via an HTTP request and simply checking the IP address isn't an option, you can have your cron run a script similar to "runcron.php". That script would in turn make a CURL or WGET request to the actual cron script you want to run.

That would allow you to pass a dynamic hash instead of a static key. That would prevent someone from just repeating the HTTP request if they happen to sniff the traffic. For the hash you could use anything dynamic like the date combined with a salt.

Example:

if (md5('secretword') . date('H')) == $_GET['hash']) { // do cron }

That would at least rotate your key once an hour.

If this script is never going to be run from the browser, you should place the file outside of your web root directory where browsers cannot reach it and just have your cron run the script at the alternate location. It would definitely be the most secure way to do it.

If you're on a shared hosting environment, you may need browser access for manual running. I would just use SSH to manually run the file from its location since it only takes me a couple seconds to login to SSH and get to the directory. Personally, I just prefer not to have excess pages laying around on my website.

Also, crontab won't let you pass GET variables. You'll have to do this -

/usr/bin/php /home/blah.php hello

Then in the script -

$argv = $_SERVER['argv'];
echo $argv[1];

Someone correct me if I'm mistaken.

This is a technique that facebook uses on their logout.php file, so that if someone sends a link to logout.php it won't log them out. I would recommend doing this.

$mysecret_word = "abc123";

if ($_GET['asd2edxc32cwqcxad'] === $mysecret_word){
    // execute my stuff here
} else {
  error_log('oopis');
  header('HTTP/1.0 404 Not Found');
  die();
}