Hiding the action on a page when the source is viewed? 2

[trantron]

The problem is that I have a validated form to collect basic info from the user like name and email etc. If one views the source code the action is visible, so along with that the name of the next php file can easily be identified. This php file is where the information is sent to the database.

This weekend somebody went on the site and by passed the validated form that collects the information and just went straight to the php file resulting in empty files being sent to the database. They did this repeatedly.

How can I prevent people from seeing or accessing that php file?

Thanks in advanced

 

[jimoblak]

Use sessions to be certain that the user has been coming from your own site.

- - picklefish - -
Why is everyone in this forum responding to me as picklefish?

 

[smashing]

A simpler way may be to just put a hidden field in the form and give it some value for example:
<input type="hidden" name="autho" value="whatever">

and then right at the top of your php script that processes that form put this (assuming the method is POST):


if (!$_POST[autho]) {
//then they didn't come from your form and should be redirected to it
header ("Location:

http://www.yoursite.com/validation_form.html");

exit;
}

 

[trantron]

Thanks.
Do you have any links handy that you can send me to for more info?

 

[jimoblak]

Can't the external site also include the same hidden field?

I direct-link to remote forms all the time and hidden links are no obstacle for an idiot like me. The only way to ensure that this remote form submission does not work is to establish a relationship with your visitor before they reach the form submission page. You can do this with cookies, sessions, or checking for referrer URLs. Sessions are most reliable.

- - picklefish - -
Why is everyone in this forum responding to me as picklefish?

 

[trantron]

Thanks Smashing. I think I will try this.

 

[jimoblak]

Ooops - one more method that I missed was a user challenge. You have most likely seen this before when doing registrations for email at yahoo.com or whois lookups at

http://www.geektools.com/whois.php.

A small text string is presented as a graphic in the web page and the user must type the string in a form field to recognize that a human being is sending the form, not an automated function.

phpclasses.org has a good library of code to experiment with.

- - picklefish - -
Why is everyone in this forum responding to me as picklefish?

 

[smashing]

jimoblak , I'm not that of a genius (or idiot!) myself, I found this in the book that tought me PHP "PHP fast & easy web developement" by Julie C. Meloni. I guess if you're really commited to hacking a site you could overcome this by creating a form yourself and posting it to that script, but it probably would stop the average troublemaker with just a little more than average html knowledge. Besides, don't those browser messages for not accepting cookies get activated for sessions as well?

 

[jimoblak]

That's a good book but it and many others focus on 'fast and easy' while doing little with security. I'm still looking for a good book on that.

The problem that can occur with a hidden field is if it uses a static variable. So if I copy the hidden field into my own form, I could use it forever to submit to another site. You can defeat this if you pass a time-sensitive variable in the hidden field and verify the variable when it is accepted by your own server. But this can get more confusing than simply using sessions.

Employing a counter with sessions can also prevent multiple submissions, even if from your own form.

Hopefully those too paranoid to enable cookies will not be submitting their name and email on trantron's form.

I'm not discounting the hidden field idea. Trantron can simply cycle through all of the options listed here as each one is defeated. In a year or two we'll need to authenticate data submissions with a thumbprint and retina scan. I'm already hard at work trying to figure ways to defeat those identity checks.

- - picklefish - -
Why is everyone in this forum responding to me as picklefish?