1

So you have a checkbox or a radio button with a predifined value to be sent to the database:

<input name="statement" type="radio" value="AWENSOME">

But someone or a script, with bad intention can easily change the value of your checkbox/radio button with for example a basic "browser page inspect" and then send other value to the databse. For example:

<input name="statement" type="radio" value="NOT SO AWENSOME! STUPID">

How can one prevent that guys? Thank you.

agaezcode
  • 168
  • 2
  • 2
  • 15

4 Answers4

2

No, you can't, the best way is to gather all allowable input values in the database and check those values everytime on the server. It is easy in case of inputs like checkbox, select, radio, because you know exactly what the values can be. In case of text inputs, you have to use regex and sanitanization.

n-dru
  • 9,285
  • 2
  • 29
  • 42
  • I agree, the only way is to replace each of the string your put in your attribute by database entry, but could slow down overall performance of your web page. – Anwar Feb 26 '15 at 09:46
  • 1
    For better performance it can be also stored in array defined in static class or for example in APC cache. – n-dru Feb 26 '15 at 09:52
  • Ok, thank you guys. I was trying to see if it was an other solutions to solve these problems. I think I'll go with the solution of comparing from the server side... Thank you. – agaezcode Feb 26 '15 at 09:53
1

You cannot totally prevent the user from modifying the html scripts in the browser, but you can prevent unnecessary data to enter in your database..

In order to prevent that, you should have a validator in your php scripts in the server side.

There are many ways in preventing invalid data to enter in the db:

  1. make a list of valid values in the database and once the user selects it, the server will check if the value in the checkbox or radio is existing
  2. make the value fo radio/checkbox an encrypted or lets say there is some unique format like zkdie23doo44s that can be identified by your server..
  3. periodically, check the html checkboxes and reload the values based from the original html script in the server

hope this helped you get an idea or two..

catzilla
  • 1,901
  • 18
  • 31
1

You can't do that you have to check once again on the server side and for the boxes like check box you know the value and for text box you can use regular expression

varad mayee
  • 619
  • 7
  • 19
1

Maybe something like this in your model would help if your are using php:

if ($data['statement'] == 'AWENSOME' || $data['statement'] == 'FOOBAR' )
{
   $statement = $data['statement'];
} else
{
   // abort the app or return an error to the user
}
hailton
  • 591
  • 1
  • 3
  • 15