RE: [phplib] Registering form variables From: Jeff Stuart (jstuart <email protected>)
Date: 09/12/00

In this case, he meant telnetting to port 80 on the web server and then
typing in the post command. This can be a good debugging tool when things
aren't working. :) Personally, what I do is verify the data that they've
sent in and if I need it for multiple forms, I'll put them into the session
AFTER I've sanitized the data. 

--
Jeff (FurBall)
WebOverdrive Newbie Tech Board
http://www.topniche.com/tech/
furball <email protected>

-----Original Message-----
From: R.B. Scholtus [mailto:regiment <email protected>]
Sent: Tuesday, September 12, 2000 6:59 PM
To: Jens Benecke; Phplib <email protected> Netuse. De E-mail"
Subject: Re: [phplib] Registering form variables

If users have telnet access they can read your database passwords and change
anything they want. we have discussed this before and the only solution is
to disable telnet access.

You can check the referrer and find out if the form data is from a local
file or from the real website, but you have a good point!!!

Brian

ps. what email program are you using? i receive all your mail as attachments
:-)

On Tue, Sep 12, 2000 at 11:46:11PM +0200, R.B. Scholtus wrote:

> You can also use POST vars to make sure the input is valid (=post data)
> and not user 'generated' (=get data). For example in order.php3:

er, what exactly prevents me from creating a local html file with a form
that does method=POST onto your results/processing page?

what prevents me from telnetting to the web server and then manually typing

POST doit.php3 .... etc

?

Sorry if I'm blind, but this is no solution for me ;)

--
`Man sollte dem Verantwortlichen für ILOVEYOU alles
http://www.linuxfaq.de
 mögliche antun, aber wahrscheinlich wird bloß
http://www.hitchhikers.de
 seine Firma zweigeteilt." -- Usenet
http://www.pinguin.conetix.de

----- Original Message -----
From: "Jens Benecke" <phplib <email protected>>
To: "Phplib <email protected> Netuse. De E-mail"" <phplib <email protected>>
Sent: Tuesday, September 12, 2000 11:56 PM
Subject: Re: [phplib] Registering form variables

---------------------------------------------------------------------
To unsubscribe, e-mail: phplib-unsubscribe <email protected>
For additional commands, e-mail: phplib-help <email protected>

---------------------------------------------------------------------
To unsubscribe, e-mail: phplib-unsubscribe <email protected>
For additional commands, e-mail: phplib-help <email protected>