An input form with a hidden field, how to protect it

Question

After I knew how to ensure image loading. Bypassing form input fields for uploading unwanted files , I would like to give another example of 2 submitted files, one of them is hidden.

SQL table (id, name, jod, number)

CREATE TABLE `users` ( `id` bigint(20) unsigned NOT NULL auto_increment, `name` varchar(255) default '0', `job` varchar(255) default NULL, `number` varchar(255) default NULL ) ENGINE=MyISAM DEFAULT CHARSET=utf8; 

Form code (support member will edit his own information)

 <form action="send.php" method="post" name="send" id="send"> <input type="text" name="name" id="name" value="John"/> <input type="text" name="job" id="job" value="Plumber"/> <input type=hidden name="number" id="number" value="1234"/> <input type="Submit" name="Submit" value="Submit"/> </form> 

Subsequently, the firefox extension appeared, which can bypass various input data on the server side, bypassing verification and can cause great damage, so here it can stop the entire process and make it possible to change the value of the hidden table number for any type value="1" , which causes information about update for member, there is value number 1 .

This extension works as follows: it can fake input before transferring it to the server.

PHP Code Send.php

 if(isset($_POST['send'])){ $name = mysql_real_escape_string($_POST[name]); $job = mysql_real_escape_string($_POST[job]); $number = mysql_real_escape_string($_POST[number]); $sql= "update users SET name='$name',job='$job' WHERE number='$number'"; mysql_query($sql) or die("query failed: $sql".mysql_error()); echo "Update Done"; } else { echo "Nothing to update"; } 

Question How then to protect this simple form from such an input form? ~ Thanks

these problems really hurt because it made my site free to hack :)

Answer 1

If user authorization is not an option for your reason, you can try the following methods:

• Set a hidden field with a hash of a number salty with other information.
• Set a hidden field with an encrypted number (possible salt can also increase security).

Of course, this would add extra steps when submitting the HTML form and checking the message information, but at least it would be much more difficult for an attacker to fake a valid number in the message. Although this will not save you if the attacker knows the encrypted / hashed number of another user, if reasonable information containing a hidden field is not used.

Answer 2

You cannot control which data users send to your server.

You need to check on the server whether the user is allowed to view the information or make the changes that they specify.

For instance:

can edit the value of the hidden table number for any value, such as value = "1", with the result that the update information for the member has a value of 1.

The process will look something like this:

• Is anyone allowed to edit this field? If yes, then OK.
• Is a request being made from an authenticated user? If not, return the error message and login form
• Does the request come from the user with id = 1? If yes, then OK
• If the request comes from a user who has administrator permissions? If yes, then OK
• Return the error message.

Answer 3

If you have a form and any users to edit values, this problem will be there. The best approach is user authentication. Allow only users who are logged in with the account to make changes to the respective accounts.

Also, don't use mysql_query or something like mysql_ *, they are unsafe and depreciate in php5.