Re: Munging hidden/form variables

I would think you should be able to write a random string to a file when the form page is accessed, and carry a variable with the action then have the recipient compare. Presents other challenges but should give you that comforting feeling he was looking for. On Thu, 1 Mar 2001 php3@developersdesk.com wrote: > Date: Thu, 1 Mar 2001 16:18:08 MST > From: php3@developersdesk.com > To: "Boget, Chris" <Chris.Boget@wild.net>, php-general@lists.php.net > Subject: Re: [PHP] Munging hidden/form variables > > Addressed to: "Boget, Chris" <Chris.Boget@wild.net> > php-general@lists.php.net > > ** Reply to note from "Boget, Chris" <Chris.Boget@wild.net> Thu, 1 Mar 2001 > 14:26:16 -0600 > > > > ------_=_NextPart_001_01C0A28D.E2F45248 > > Content-Type: text/plain; > > charset="iso-8859-1" > > > > It is possible (I've done it) to find out all the variables > > that make up a form on a particular site, generate a > > similar form on your site with that form's action being > > the CGI/PHP script that the particular site uses to process > > the form once submitted, modify the values for the form > > variables to be anything you want and submit the form > > that resides on your site. This will basically submit totally > > fabricated data to the foriegn site and possibly screw them > > up somehow and/or in some way. > > > > Is there any way to defend against this? Is there any way > > to ensure that when a form is submitted that the submission > > request originated from your site/domain and not somewhere > > else? > > > No. There is no way to tell a clever programmer from a live human on > the other end of an Internet connection. You may be able to make it > harder, say making sure your form page is hit before the results are > returned, but that is easy to defeat. > > > > > > Rick Widmer > Internet Marketing Specialists > http://www.developersdesk.com > > -- > PHP General Mailing List (http://www.php.net/) > To unsubscribe, e-mail: php-general-unsubscribe@lists.php.net > For additional commands, e-mail: php-general-help@lists.php.net > To contact the list administrators, e-mail: php-list-admin@lists.php.net > Kelly 303-444-1671 Boulder, Colorado