|
Posted by SJ on July 20, 2005, 9:22 am
If you were Registered and logged in, you could reply and use other advanced thread options
cosmic foo wrote:
> Would i be correct to assume that anything
> can be posted, it's up to the receiving page
> to deal with what it receives?
> So one may as well assume that a hacker
> can figure out what a page expects or
> doesn't expect to receive, and post
> whatever they feel like trying.
> So it would be incorrect to assume that
> just because someone cannot get to a page,
> that they cannot post to the page that it posts to.
> So it's important to put as much security as
> possible into the page being posted to, and
> thinking that hidden form fields are actually
> hiding anything is a mistake, and creating any
> sort of generic post page that updates records
> in a database may be impossible to secure.
I disagree. Every server-side application/script
must sanitize and validate its input. All variables.
It should check the input is syntactically correct
(eg. only numbers) and it has a correct meaning
(eg. a valid email address).
Additionally you may authenticate users before
submitting data to your database, thus you may
track your rude users down.
SJ
| 
XML site map