Re: another Quickform security question
| From: | Justin Patrin | Date: | Mon, 03 Oct 2005 20:04:07 +0000 |
| Subject: | Re: another Quickform security question | ||
| References: | 1 | Groups: | php.pear.general |
| Request: | Send a blank email to pear-general+get-21212@lists.php.net to get a copy of this message | ||
On 10/3/05, l Burnerheimerton <lburnerheimerton@yahoo.com> wrote:
> So I am ABSOLUTELY clear on this, in order to sumbit a
> form in the most secure way using Quickform, I should
> create a rule for *ALL* submitted fields. Correct?
>
I don't know what you're asking. If you want to verify something about
a field you always have to set up a rule. Otherwise, how do you know
that it is what you want?
For hiddens, use setConstants to make sure they stay the value you wanted.
For elements which have to be in a certain format verify them.
Also, make sure to think about XSS and SQL injection. For some more on this:
http://pear.reversefold.com/dokuwiki/doku.php?id=phpfaqs
--
Justin Patrin