Re: Self-Process php forms or not?
| From: | Tom Worster | Date: | Sat, 03 Oct 2009 13:42:43 +0000 |
| Subject: | Re: Self-Process php forms or not? | ||
| References: | 1 | Groups: | php.general |
| Request: | Send a blank email to php-general+get-298512@lists.php.net to get a copy of this message | ||
On 10/2/09 10:24 AM, "tedd" <tedd.sperling@gmail.com> wrote:
> At 1:55 PM +0530 10/2/09, kranthi wrote:
>> and yes i forgot to mention... i avoid hidden form elements because
>> they can be modified very easily and hence pose a security threat.
>
> That depends upon how sloppy you are in coding.
>
> NONE of my hidden variables pose any security problems whatsoever.
...because one always assumes that data supplied in an http request is
tainted. hence arguments about which exploit is more likely is rather
pointless.
a hidden input is really no different from any other form field. kranthi's
argument would be consistent if he felt that all form inputs should be
avoided because they are so easily modified as to pose a security threat.