Re: is my form safe enough ?

>if the below snippet is called form.php, >have I done enough to prevent something like: >http://mydomain.com/form.php?var=somejunkVal > >nb: my register_globals = on > ><? >if ($_POST["submit"]) { > print "the value that you typed was:". $_POST["var"]; > /* > write $_POST["var"] to db Yes, but... There is nothing to stop me from copying your HTML FORM to my hard drive, altering its contents, and sending you: <INPUT TYPE=TEXT NAME=var VALUE=somejunkVal> You *MUST* assume that the data coming from the Internet is *BAAAAAAAAAAAAAD* until you have proven it otherwise. Try it yourself and see. Use "View Source" on your FORM Copy all the HTML. Save it somewhere on your hard drive Edit it to send in some wacky data. -- Like Music? http://l-i-e.com/artists.htm