Tycoon Talk
Become a Big fish!
The number 1 forum for online business!
Post topics, ask questions, share your knowledge.
Tycoon Talk is part of Freelancer.com - find skilled workers online at a fraction of the cost.

PHP Forum


You are currently viewing our PHP Forum as a guest. Please register to participate.
Login



Freelance Jobs

Reply
How to secure select boxes?
Old 09-10-2009, 02:06 AM How to secure select boxes?
Knight13's Avatar
Defies a Status

Posts: 10,285
Name: Knight13
Location: Cleveland, Ohio
Trades: 0
Lets say i have a select box like this below

HTML Code:
<select name="title">
<option value="One">One</option>
<option value="Two">Two</option>
</select>
and i need to add the information to a database when someone chooses an option i know that i have to make sure that what is in the select boxes is what is meant to be in their, but i am not positive how to do this since their are lots of different options.

Below is what i thought of doing.

PHP Code:

<?php

if(!preg_replace("/^[a-zA-Z]+$/",$title)){
    echo 
'Error message will go here';
}else{
    
$title $title;
}

?>
Is the above code the right way to validate select boxes?
Knight13 is offline
Reply With Quote
View Public Profile
 
 
Register now for full access!
Old 09-10-2009, 07:31 AM Re: How to secure select boxes?
Extreme Talker

Posts: 181
Name: David Jackson
Trades: 0
you dont have to validate against the text of an option in a select box as the values have been predetermined by yourself
__________________

Please login or register to view this content. Registration is FREE
davidj is offline
Reply With Quote
View Public Profile
 
Old 09-10-2009, 08:27 AM Re: How to secure select boxes?
Experienced Talker

Posts: 44
Name: Maneet Puri
Trades: 0
Quote:
Originally Posted by Knight13 View Post
Lets say i have a select box like this below

HTML Code:
<select name="title">
<option value="One">One</option>
<option value="Two">Two</option>
</select>
and i need to add the information to a database when someone chooses an option i know that i have to make sure that what is in the select boxes is what is meant to be in their, but i am not positive how to do this since their are lots of different options.

Below is what i thought of doing.

PHP Code:

<?php

if(!preg_replace("/^[a-zA-Z]+$/",$title)){
    echo 
'Error message will go here';
}else{
    
$title $title;
}

?>
Is the above code the right way to validate select boxes?

Hi,

The select box is being created in the page you will be creating so you can put the appropriate data there, or what you can do is put the appropriate data in a table and generate this select box from it so you will not have to worry if the value being passed is correct or not.

Hope this helps.

Cheers,

~Maneet
__________________

Please login or register to view this content. Registration is FREE
|
Please login or register to view this content. Registration is FREE
maneetpuri is offline
Reply With Quote
View Public Profile
 
Old 09-10-2009, 08:35 AM Re: How to secure select boxes?
chrishirst's Avatar
Missing! presumed drunk.

Posts: 41,517
Name: Chris Hirst
Location: Blackpool. UK
Trades: 0
And WHAT is the point of the code in the above post??????


YOU CANNOT TYPE INTO A SELECT BOX!!!!!! only the predetermined options can be selected.

SO if YOU choose to add an option value that is incorrect for that use. I would suggest you deserve the problems it may cause!!!
__________________
Chris. ->> Links are advertising NOT optimising!! <<-
A foolish consistency is the hobgoblin of little minds
Thought for today:- I SEO the only industry where all the cowboys are Indians?
chrishirst is offline
Reply With Quote
View Public Profile Visit chrishirst's homepage!
 
Old 09-10-2009, 02:33 PM Re: How to secure select boxes?
mgraphic's Avatar
Truth Seeker

Latest Blog Post:
JAMISONTUNES
Posts: 2,898
Name: Keith Marshall
Location: Connecticut
Trades: 0
Well, rule #1 is to never trust user input so it's good that you're trying to validate data. One of my favorite and easy methods of this type is comparing against an array of valid values.

PHP Code:
if (!in_array($_POST['title'], array('One''Two'))) echo 'Error message will go here'
__________________

<mgraphic /> - I don't have a solution but I admire the problem.
mgraphic is offline
Reply With Quote
View Public Profile
 
Old 09-10-2009, 04:39 PM Re: How to secure select boxes?
Knight13's Avatar
Defies a Status

Posts: 10,285
Name: Knight13
Location: Cleveland, Ohio
Trades: 0
chrishirst~
I know that a person cannot type into a select box but i read somewhere that people can forge select box information, i personally do not know if that is true or not but i wanted to make sure, that is why i asked the question.

mgraphic~
That seems like a good thing to do but i have on select box with the names of all the countries in it and i really do not want to type in every singles country by hand is their any other way to validate it, where i do not have to type in every country? and do i even need to do it? i'm confused now.
Knight13 is offline
Reply With Quote
View Public Profile
 
Old 09-10-2009, 05:53 PM Re: How to secure select boxes?
NullPointer's Avatar
Will Code for Food

Posts: 2,784
Name: Matt
Location: Irvine, CA
Trades: 0
Quote:
Originally Posted by Knight13 View Post
I know that a person cannot type into a select box but i read somewhere that people can forge select box information, i personally do not know if that is true or not but i wanted to make sure, that is why i asked the question.
It is true. For instance, in Opera if I wanted to add an option to a select field all I would have to do is view the source, manually type in the option code, and then click update and then I can submit the form as if the option I manually added was completely valid.

Edit:
This feature turns out to be very useful for a developer to test changes to a site on the fly, but it has obvious malicious uses as well.

Quote:
Originally Posted by Knight13 View Post
That seems like a good thing to do but i have on select box with the names of all the countries in it and i really do not want to type in every singles country by hand is their any other way to validate it, where i do not have to type in every country? and do i even need to do it? i'm confused now.
Unfortunately the only way to validate the data in this case is to check if the user submitted value is equal to one of the valid values. This means you'll need to have an array or some kind of list of countries. Personally if I were doing this I would use the same array for generating the select field and validating it:

PHP Code:
<?php
$countryList 
= array( ... ); //your list of countries

function generateCountryList()
{
     global 
$countryList;
     
?>
     <select name="country">
     <?php foreach($countryList as $c) : ?>
          <option value="<?php echo $c?>"><?php echo $c?></option>
     <?php endforeach; ?>
     </select>
     <?php
}

function 
validateCountry($userInput)
{
     global 
$countryList;

     if(
in_array($userInput$countryList))
          return 
true;

     return 
false;
}
?>
__________________

Please login or register to view this content. Registration is FREE
|
Please login or register to view this content. Registration is FREE
|
Please login or register to view this content. Registration is FREE
|
Please login or register to view this content. Registration is FREE

Last edited by NullPointer; 09-10-2009 at 05:58 PM..
NullPointer is online now
Reply With Quote
View Public Profile Visit NullPointer's homepage!
 
Old 09-10-2009, 08:25 PM Re: How to secure select boxes?
Knight13's Avatar
Defies a Status

Posts: 10,285
Name: Knight13
Location: Cleveland, Ohio
Trades: 0
Thanks Nullpointer, i understand what you mean.
Knight13 is offline
Reply With Quote
View Public Profile
 
Reply     « Reply to How to secure select boxes?
 

Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Trackbacks are Off
Pingbacks are Off
Refbacks are Off





   
RSS Feed  Feeds: RSS   JS   XML
RSS Feed  Feeds for this forum: RSS   JS   XML



Page generated in 0.39920 seconds with 12 queries