Beefy Boxes and Bandwidth Generously Provided by pair Networks
There's more than one way to do things

Re^5: CGI recipient Option

by iburrell (Chaplain)
on Sep 02, 2004 at 16:35 UTC ( #387983=note: print w/replies, xml ) Need Help??

in reply to Re^4: CGI recipient Option
in thread CGI recipient Option

Unfornately, hardcoded values in the form are just as insecure as regular form values. There are two ways to attack a script. One is to put values in the form; hidden fields are safe from this. The other is to construct a fake POST after looking at the form. This is easy to do, and any value can be passed for any form field.

If you can, hardcoding the values in the script or a config file is much safer. You might not be able to if the values depend on which page is doing the calling, or is coming from a select box.

With fixed form fields, your validation job is easier. You know exactly what values are present in the page and what their format is. You don't need to accept input from people who will enter all kinds of stuff. You don't have to worry about nice error message. If there is an illegal value in a hidden form field, either there is a bug or someone is making an attack.

Log In?

What's my password?
Create A New User
Domain Nodelet?
Node Status?
node history
Node Type: note [id://387983]
and the web crawler heard nothing...

How do I use this?Last hourOther CB clients
Other Users?
Others lurking in the Monastery: (6)
As of 2023-11-29 11:40 GMT
Find Nodes?
    Voting Booth?

    No recent polls found