Re: POST security
| From: | Dan Anderson | Date: | Fri, 05 Sep 2003 15:34:19 +0000 |
| Subject: | Re: POST security | ||
| References: | 1 | Groups: | php.general |
| Request: | Send a blank email to php-general+get-161773@lists.php.net to get a copy of this message | ||
Be careful about hidden variables and form variables. A clever user can
create a new form with custom edited fields and ACTION="yoursite.com"
For instance, if you keep a hidden variable:
<INPUT TYPE=HIDDEN NAME='authorization_bool' VALUE='FALSE'>
It's not very hard for a computer saavy person to create a new form
where it says:
<INPUT TYPE=HIDDEN NAME='authorization_bool' VALUE='TRUE'>
And circumvent your authorization.
-Dan
On Fri, 2003-09-05 at 10:32, bob pilly wrote:
> Hi all, i know this isnt strictly a php question but
> thought you would be a good group to ask because of
> your experience.
>
> Is there any security issues with passing data via the
> POST method from a webserver to a different webserver
> running ssl. For example:
>
> webserver1
>
> <form name='form1' method='POST'
> action='https://webserver2/login.php'>
> <input type='hidden' value='lalala' name='data'>
> </form>
> and then just using <?$data=$_POST[data];?> on
> webserver 2 to retrieve the data?
>
> Thanks for any help in advance.
>
>
>
> ________________________________________________________________________
> Want to chat instantly with your online friends? Get the FREE Yahoo!
> Messenger http://mail.messenger.yahoo.co.uk