note 83266 deleted from security.variables by danbrown
| From: | danbrown@php.net | Date: | Fri, 20 Aug 2010 20:04:12 +0000 |
| Subject: | note 83266 deleted from security.variables by danbrown | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-171903@lists.php.net to get a copy of this message | ||
Note Submitter: f dot zijlstra at gmail dot com
----
I'd like to note that the 'easysecure' thing posted below is NOT a secure way to
validate that the form was indeed submitted from a browser. In fact, there is NO way you can
guarantee that.
A smart person with bad intentions can easily parse the HTML page to fetch the generated token and
pass it on. The only way to secure your forms is to explicitly check every variable against
potentially dangerous values.