Munging hidden/form variables

From: Date: Thu, 01 Mar 2001 20:26:16 +0000
Subject: Munging hidden/form variables
Groups: php.general 
Request: Send a blank email to php-general+get-42217@lists.php.net to get a copy of this message
It is possible (I've done it) to find out all the variables that make up a form on a particular site, generate a similar form on your site with that form's action being the CGI/PHP script that the particular site uses to process the form once submitted, modify the values for the form variables to be anything you want and submit the form that resides on your site. This will basically submit totally fabricated data to the foriegn site and possibly screw them up somehow and/or in some way. Is there any way to defend against this? Is there any way to ensure that when a form is submitted that the submission request originated from your site/domain and not somewhere else? Any help would be greatlyl appreciated. Chris

« previous php.general (#42217) next »