Re: is my form safe enough ?

On Saturday 24 August 2002 08:34, Roger Thomas wrote: > So how do I protect from incident like that ? > > --- Bas Jobsen <bas@startpunt.cc> wrote: > > I can place a form on a other location like: > > > > <form action='http://mydomain.com/form.php' > > method='POST'> > > <input type='text' name='var' value='somejunkVal'> > > <input type='submit' name='submit' value='fake'> > > </form> You don't need to. IIRC, your code checked whether $_POST['submit'] == 'submit' In the above $_POST['submit'] = 'fake' so your code won't be executed. Anyway, apart from making sure that your variables are coming from where you expect them (ie by using $_POST/$_GET etc), you also need to do some sanity checks on them to make sure that they contain valid/expected values. As an example: supposing you have a form with a select box containing two possible values, on receiving the form you should check that the value of the select box is indeed one of those 2 values. You should never insert the value of the select box into your db without checking its validity. -- Jason Wong -> Gremlins Associates -> www.gremlins.com.hk Open Source Software Systems Integrators * Web Design & Hosting * Internet & Intranet Applications Development * /* You now have Asian Flu. */