RE: [PHP] Making sure a post request came from your site
| From: | Johnson, Kirk | Date: | Fri, 05 Apr 2002 19:01:16 +0000 |
| Subject: | RE: [PHP] Making sure a post request came from your site | ||
| Groups: | php.general | ||
| Request: | Send a blank email to php-general+get-91780@lists.php.net to get a copy of this message | ||
Good starters. I would add one more starter item: don't blindly grab
everything out of the $_POST[] array. Instead, only grab the variables that
*you* put on the form page. A cracker might send you a name/value pair like
"$admin=1", trying to guess what flag you are using for "admin" users.
Kirk
> -----Original Message-----
> From: Jason Wong [mailto:php-general@gremlins.com.hk]
> Sent: Friday, April 05, 2002 11:42 AM
> To: php-general@lists.php.net
> Subject: Re: [PHP] Making sure a post request came from your site
>
>
> > Ok, then how do you go about checking to make sure that submitted
> > data is, in fact, benign and acceptable for your use?
>
> For starters:
>
> If it's supposed to be a number make sure that it is a number.
> If it's supposed to be a name make sure it only contains
> letters a-z & A-Z &
> spaces.